CVE-2026-30932: Froxlor Path Traversal Vulnerability

CVE-2026-30932 Overview

CVE-2026-30932 is a high-severity injection vulnerability in Froxlor, an open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) fails to properly validate the content field for several DNS record types including LOC, RP, SSHFP, and TLSA. This allows an attacker to inject newlines and BIND zone file directives (such as $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs.

Critical Impact

Authenticated attackers with DNS management permissions can inject arbitrary BIND directives into zone files, potentially leading to arbitrary file reads, DNS cache poisoning, or complete DNS service compromise.

Affected Products

• Froxlor versions prior to 2.3.5
• Froxlor installations with DNS management enabled for customers
• Systems running BIND DNS server managed by vulnerable Froxlor instances

Discovery Timeline

• 2026-03-24 - CVE-2026-30932 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-30932

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as an injection vulnerability. The flaw exists in the DNS zone file generation process within Froxlor's administration panel.

The DomainZones.add API endpoint accepts user-supplied content for various DNS record types but does not sanitize or validate input for dangerous characters or BIND-specific directives. When a customer with DNS management privileges submits a DNS record with malicious content containing newline characters or BIND directives like $INCLUDE, this content is written verbatim to the zone file during the DNS rebuild cron job execution.

The attack requires network access and low-privilege authentication (a customer account with DNS enabled), making it exploitable by any authenticated user with DNS management capabilities. The vulnerability can lead to high confidentiality and integrity impacts on the affected system.

Root Cause

The root cause is insufficient input validation in the DomainZones.add API endpoint. The affected DNS record types (LOC, RP, SSHFP, TLSA) allow arbitrary content to be specified without proper sanitization. The application fails to:

1. Strip or escape newline characters (\n, \r\n) from user input
2. Detect and block BIND zone file directives such as $INCLUDE, $GENERATE, or $ORIGIN
3. Validate that the content conforms to the expected format for each DNS record type

Attack Vector

The attack is executed over the network through the Froxlor web interface or API. An attacker with a valid customer account that has DNS management enabled can exploit this vulnerability through the following mechanism:

The attacker crafts a malicious DNS record request containing newline characters followed by BIND directives. When submitted through the DomainZones.add endpoint, the payload bypasses input validation. During the next DNS rebuild cron job execution, the malicious content is written to the zone file, causing BIND to process the injected directives. For example, an $INCLUDE directive could be used to read arbitrary files from the server's filesystem and expose them through DNS responses.

Detection Methods for CVE-2026-30932

Indicators of Compromise

• Unusual DNS record entries containing newline characters or BIND directives in zone files
• Presence of $INCLUDE, $GENERATE, or $ORIGIN directives in customer-created DNS records
• Unexpected file access patterns from the BIND/named process
• DNS zone files with anomalous formatting or embedded directives outside of standard configuration

Detection Strategies

• Monitor Froxlor API calls to DomainZones.add endpoint for payloads containing newline characters or BIND directives
• Implement file integrity monitoring on DNS zone file directories to detect unauthorized modifications
• Review BIND server logs for errors related to malformed zone files or unexpected $INCLUDE processing
• Audit customer DNS record content for special characters and directive patterns

Monitoring Recommendations

• Enable detailed logging for the Froxlor API and DNS zone management functions
• Configure alerts for zone file modifications outside of expected maintenance windows
• Monitor for BIND process attempting to access files outside normal zone file directories
• Implement network-level monitoring for unusual DNS query patterns that might indicate data exfiltration

How to Mitigate CVE-2026-30932

Immediate Actions Required

• Upgrade Froxlor to version 2.3.5 or later immediately
• Audit existing DNS records for any suspicious content containing newlines or BIND directives
• Review access logs for the DomainZones.add endpoint for potential exploitation attempts
• Consider temporarily disabling customer DNS management until the patch is applied

Patch Information

The vulnerability has been addressed in Froxlor version 2.3.5. The fix implements proper input validation for the content field across all DNS record types, preventing injection of newlines and BIND directives. The specific commit addressing this vulnerability is available in the GitHub commit b34829262dc32818b37f6a1eabb426d0b277a86b. For detailed information, refer to the GitHub Security Advisory GHSA-x6w6-2xwp-3jh6.

Workarounds

• Disable DNS management functionality for customer accounts until the patch can be applied
• Implement a web application firewall (WAF) rule to block requests containing newline characters or BIND directives in DNS record content fields
• Manually review and sanitize existing zone files for any injected content
• Restrict API access to the DomainZones.add endpoint to trusted administrators only

# Check Froxlor version and upgrade if necessary
cd /var/www/froxlor
git fetch --tags
git checkout 2.3.5

# Verify zone files for suspicious content
grep -rE '^\$INCLUDE|\$GENERATE|\$ORIGIN' /etc/bind/zones/

# Review recent DNS record additions in Froxlor logs
grep -i "DomainZones.add" /var/log/froxlor/*.log