CVE-2026-41237: Froxlor has an incomplete fix for CVE-2026-30932

Synopsis

This is an input validation bypass in Froxlor, an open source server administration panel, affecting versions 2.3.6 and earlier. The flaw is reachable over the network by any authenticated low-privilege user, with no victim interaction required, and stems from multiple DNS record validators that accept malformed input: the LOC record regex permits embedded newlines, TLSA matchingType=0 imposes no length limit on hex data, and all validators return raw user input without zone-file escaping. Successful exploitation lets an attacker read and tamper with DNS zone data, with the potential to inject arbitrary zone-file content or corrupt records. A fix is available in Froxlor 2.3.7; HarborGuard tracks this advisory and a patched-image rebuild will be made available the moment a published fix version is confirmed in upstream package metadata.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Froxlor panel must be reachable over the network; an attacker sends crafted DNS record input to the application's HTTP endpoints from a remote host.

• AuthenticationRequired

  A valid low-privilege Froxlor account is sufficient to reach the affected validators; no administrative or special-role account is needed.

• Victim interactionNot required

  The attacker submits malicious input directly through their own authenticated session; no other user needs to take any action.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the malformed input passes validation reliably without requiring race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• An attacker reads the contents of DNS zone files managed by Froxlor, including records for all domains hosted on the server.
• An attacker injects arbitrary content into zone files by embedding newlines or oversized hex data, allowing DNS record manipulation such as adding or overwriting A, NS, or TLSA records.
• Corrupted or injected zone-file content can redirect traffic for hosted domains, enabling phishing, session hijacking, or interception of email and web traffic for affected tenants.
• Availability of the Froxlor service itself is not directly impacted according to the CVSS vector, but downstream DNS infrastructure handling the malformed zones may behave unpredictably.