Improper Neutralization of Special Elements in Output Used by a Downstream Component in Froxlor - CVE-2026-30932
Published: April 27, 2026
Vulnerability details
The vulnerability allows a remote user to inject arbitrary DNS records, disclose sensitive information, and cause a denial of service.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the DomainZones.add API endpoint and BIND zone file generation when processing unsanitized DNS record content for LOC, RP, SSHFP, and TLSA records. A remote user can submit crafted DNS record content containing newline characters and BIND directives to inject arbitrary DNS records, disclose sensitive information, and cause a denial of service.
Exploitation requires DNS management to be enabled for the customer account, and the injected content is written to disk when the DNS rebuild cron job runs.