CVE-2026-54347: Froxlor Server Administration XSS Flaw

CVE-2026-54347 Overview

CVE-2026-54347 is a stored cross-site scripting (XSS) vulnerability in Froxlor, an open source server administration panel. The flaw exists in the DNS zone management workflow. An authenticated customer with DNS editor access can inject JavaScript into a TXT record. When an administrator later views the affected domain's DNS configuration, the payload executes in the administrator's browser session. This exposes session data and enables privileged panel actions performed as the administrator. The issue is resolved in Froxlor 2.3.8. This vulnerability is classified under [CWE-79] and carries an EPSS score of 0.382%.

Critical Impact
A low-privileged customer can hijack administrator sessions and perform privileged panel actions by planting JavaScript in a DNS TXT record.

Affected Products

Froxlor versions prior to 2.3.8
lib/Froxlor/Api/Commands/DomainZones.php (TXT record intake)
lib/Froxlor/UI/Callbacks/Text.php and templates/Froxlor/table/table.html.twig (unsafe rendering path)

Discovery Timeline

2026-08-18 - CVE-2026-54347 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-54347

Vulnerability Analysis

The vulnerability is a stored XSS in Froxlor's DNS management interface. TXT record content is accepted from customers without HTML escaping and rendered into the administrator's DNS view. The rendering pipeline uses a Twig template that applies the raw filter to callback output, bypassing Twig's default auto-escaping. Because the payload triggers when a higher-privileged administrator loads the zone view, exploitation crosses a privilege boundary and changes the security scope. Successful exploitation allows the attacker to read session cookies, issue authenticated API calls, and manipulate panel configuration as the administrator.

Root Cause

Three code paths combine to create the flaw. First, lib/Froxlor/Api/Commands/DomainZones.php accepts TXT record content that includes HTML special characters. Second, lib/Froxlor/UI/Callbacks/Text.php returns the value from Text::wordwrap without applying htmlspecialchars. Third, templates/Froxlor/table/table.html.twig renders the callback result with the Twig raw filter, which disables output escaping. The unescaped attacker-controlled string reaches the DOM as executable markup.

Attack Vector

An authenticated customer with DNS editor rights creates or edits a TXT record containing a script payload. The payload is persisted in the Froxlor database. When an administrator opens the DNS configuration page for the affected domain, Twig renders the TXT content unescaped and the browser executes the script under the administrator's origin and session.

php

// Patch: lib/Froxlor/UI/Callbacks/Text.php
// Source: https://github.com/froxlor/froxlor/commit/a1d8f425b11ef7597949018814afa056a842cba0

public static function wordwrap(array $attributes): string
{
-    return wordwrap($attributes['data'], 100, '<br>', true);
+    return wordwrap(htmlspecialchars($attributes['data']), 100, '<br>', true);
}

The fix wraps the input with htmlspecialchars before passing it to wordwrap, neutralizing HTML metacharacters before the Twig raw filter renders the string.

Detection Methods for CVE-2026-54347

Indicators of Compromise

TXT records that contain <script, onerror=, onload=, or javascript: substrings in Froxlor zone data.
Unexpected administrator-initiated API calls to DomainZones, user management, or configuration endpoints originating from browser sessions rather than scripted clients.
New administrator accounts, permission changes, or SSH key additions correlated with an administrator viewing a customer zone.

Detection Strategies

Query the Froxlor database for TXT record entries containing HTML tag characters or common XSS sink strings.
Inspect web server access logs for administrator sessions that loaded a domain zone view and then issued rapid state-changing POST requests.
Deploy a Content Security Policy in report-only mode and monitor violation reports from the Froxlor admin origin.

Monitoring Recommendations

Alert on the creation or modification of TXT records containing angle brackets, event handler attributes, or protocol handlers.
Track administrator session activity for behavioral deviation immediately after DNS zone views.
Audit privileged panel changes such as customer role escalations, mail account creation, and SSH key registration.

How to Mitigate CVE-2026-54347

Immediate Actions Required

Upgrade Froxlor to version 2.3.8 or later on all panel instances.
Review existing TXT records across all customer zones for HTML or JavaScript content and remove suspicious entries.
Rotate administrator session cookies and API tokens after patching.
Audit recent administrative actions for changes that correlate with viewing customer DNS zones.

Patch Information

The fix is included in Froxlor 2.3.8. See the GitHub Release Tag 2.3.8, the GitHub Security Advisory GHSA-43gm-9rr3-cx7g, and the remediation commit. The patch applies htmlspecialchars to TXT record content before the wordwrap callback returns to the Twig template.

Workarounds

Restrict DNS editor privileges to trusted customers until the upgrade is applied.
Disable the customer-facing DNS editor feature in Froxlor settings if the panel cannot be updated immediately.
Enforce a strict Content Security Policy on the Froxlor admin interface to limit inline script execution.

bash

# Upgrade Froxlor to a patched release
cd /var/www/froxlor
git fetch --tags
git checkout 2.3.8
php bin/froxlor-cli froxlor:update
systemctl reload php-fpm nginx