CVE-2026-54347

Received Received - Intake

Stored XSS in Froxlor DNS TXT Records

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain's DNS configuration, the payload executes automatically in the administrator's browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-54347

EUVD

EUVD-2026-61219

Affected Vendors & Products

Vendor	Product	Version / Range
froxlor	froxlor	2.3.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Froxlor allows an authenticated customer with DNS editor access to inject JavaScript code into a DNS TXT record. When an administrator views the domain's DNS configuration, the malicious script executes in the administrator's browser session. This happens because the system fails to properly escape HTML special characters in the TXT record content.

Detection Guidance

Check Froxlor versions prior to 2.3.8 for DNS TXT records containing JavaScript-bearing content. Inspect browser-rendered DNS configuration pages for unexpected script execution. Manually review TXT records in Froxlor admin panel for HTML special characters or payloads.

Impact Analysis

An attacker could steal session data or perform privileged actions in the Froxlor panel by tricking an administrator into viewing a malicious DNS configuration. This could lead to unauthorized access, data breaches, or further compromise of the server administration system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's security rules. Organizations using affected Froxlor versions may face compliance violations if user data is exposed due to this issue.

Mitigation Strategies

Upgrade Froxlor to version 2.3.8 or later immediately. Remove any suspicious TXT records containing JavaScript payloads. Restrict DNS editor access to trusted users only. Monitor admin panel sessions for unauthorized actions.

Hi! I’m here to help you understand CVE-2026-54347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70