CVE-2026-54347

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.8

Description An authenticated customer with DNS editor access can store JavaScript in a DNS TXT record because the lib/Froxlor/Api/Commands/DomainZones.php file accepts HTML special characters. The Text::wordwrap() function in lib/Froxlor/UI/Callbacks/Text.php returns content without HTML escaping, and the templates/Froxlor/table/table.html.twig file renders this result using a raw filter. When an administrator views the DNS configuration of the affected domain, the stored payload executes automatically in their browser session, potentially exposing session data or allowing privileged panel actions.

Recommendations Update to version 2.3.8.