CVE-2026-30932
Froxlor ≤ 2.3.5
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-30932 is a high-severity Injection (CWE-74) vulnerability in Froxlor Froxlor. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Dynamic Linker Hijacking (T1574.006); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30932 is an injection vulnerability (CWE-74) in Froxlor, an open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint, which is accessible to customers with DNS enabled, fails to validate the content field for specific DNS record types including LOC, RP, SSHFP, and TLSA. This allows attackers to inject newlines and BIND zone file directives, such as $INCLUDE, into the zone file that is subsequently written to disk during the execution of the DNS rebuild cron job. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Customers with DNS enabled in Froxlor deployments can exploit this vulnerability remotely over the network with low privileges, requiring no user interaction. By submitting malicious content via the DomainZones.add API, an attacker can manipulate the generated BIND zone file, potentially leading to unauthorized inclusion of external files, zone file tampering, or further compromise of the DNS infrastructure and underlying server, resulting in high confidentiality, integrity, and availability impacts.
The issue has been addressed in Froxlor version 2.3.5, as detailed in the project's security advisory (GHSA-x6w6-2xwp-3jh6), release notes, and the patching commit. Security practitioners should upgrade to version 2.3.5 or later and review access controls for the DomainZones.add endpoint to mitigate exposure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14964
Vulnerability Data
Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject…
more
newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.1V1.2.3V1.2.5V1.2.8
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection attacks in software design.
Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.
Secure coding standards require proper neutralization of special elements, directly addressing CWE-74.