CVE-2026-54347
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Froxlor before version 2.3.8 contains a Stored XSS vulnerability in DNS TXT record content, which is not properly escaped before rendering in the admin panel. An authenticated customer with DNS editor access can inject JavaScript that executes in the administrator's browser session.
Risk Assessment
The risk includes session hijacking and unauthorized actions in the admin panel, potentially compromising system integrity and confidentiality.
Recommendation
Upgrade Froxlor to version 2.3.8 or later, which includes the fix for this XSS vulnerability.
Original NVD description (English source)
Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain's DNS configuration, the payload executes automatically in the administrator's browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.