CVE-2026-54347 froxlor CVE debrief

Who should care

Administrators and security teams responsible for Froxlor installations should assess exposure and prioritize remediation. They should verify and upgrade to version 2.3.8 or later, restrict DNS editor access, and monitor for suspicious DNS configuration views.

Why it matters

CVE-2026-54347 is a stored XSS vulnerability in Froxlor's DNS TXT record handling. An authenticated customer with DNS editor access can store JavaScript-bearing content, which executes in an administrator's browser session when viewing the DNS configuration. Defenders should prioritize verifying and upgrading to version 2.3.8 or later, restricting DNS editor access, and monitoring for suspicious DNS configuration views. The impact is limited to the scope of DNS editor access and administrator browser sessions.

• Session data exposure through JavaScript execution in administrator browser sessions
• Potential for performing privileged panel actions through stored XSS payloads
• Verification of DNS editor access controls and payload execution prevention required

Technical summary

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. This allows an authenticated customer with DNS editor access to store JavaScript-bearing content, which executes in an administrator's browser session when viewing the DNS configuration.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2.3.8 or later, restricting DNS editor access, and monitoring for suspicious DNS configuration views.

Recommended defensive actions

• Verify and upgrade to version 2.3.8 or later
• Restrict DNS editor access to authorized personnel
• Monitor for suspicious DNS configuration views and payload execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is fixed in version 2.3.8. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. The vulnerability exists due to a lack of HTML escaping in lib/Froxlor/UI/Callbacks/Text.php and templates/Froxlor/table/table.html.twig. Evidence is based on source-provided information and limited to public data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.