DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54347: CVE-2026-54347: Stored Cross-Site Scripting in Froxlor DNS TXT Record Configuration

#security #cve #cybersecurity

CVE-2026-54347: Stored Cross-Site Scripting in Froxlor DNS TXT Record Configuration

Vulnerability ID: CVE-2026-54347
CVSS Score: 8.7
Published: 2026-08-18

A critical stored Cross-Site Scripting (XSS) vulnerability was identified in Froxlor server administration software panel before version 2.3.8. Authenticated customers with DNS editor privileges can inject malicious JavaScript into DNS TXT records. Because the application processes these values via a raw formatting callback without context-aware HTML entity encoding, the payload executes in the security context of administrative users who view the affected domain's DNS zones.

TL;DR

Authenticated customers with DNS editing access can store malicious JavaScript in DNS TXT records, leading to arbitrary code execution in the browser of any administrator who views the domain's configuration.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v3.1: 8.7
  • Exploit Status: poc
  • KEV Status: Not listed
  • Impact: Administrative Session Hijacking / Privilege Escalation

Affected Systems

  • Froxlor Server Administration Panel
  • Froxlor: < 2.3.8 (Fixed in: 2.3.8)

Code Analysis

Commit: a1d8f42

escape allowed special-characters in dns TXT content in frontend

Mitigation Strategies

  • Upgrade Froxlor to version 2.3.8 or later to apply context-aware htmlspecialchars formatting.
  • Apply manual hotfixes to formatting callbacks if software upgrades are delayed.
  • Implement Content Security Policy (CSP) headers without 'unsafe-inline' to prevent runtime script execution.
  • Perform regular audits of panel_dns tables to identify unauthorized HTML markup inside DNS TXT records.

Remediation Steps:

  1. Backup the current Froxlor database and file structure.
  2. Update Froxlor packages or pull from the official Git repository for release version 2.3.8.
  3. Verify that lib/Froxlor/UI/Callbacks/Text.php includes htmlspecialchars wrapper in the wordwrap method.
  4. Audit active DNS records using SQL queries to detect and remove existing script payloads.
  5. Configure web server headers to deliver rigid Content Security Policies.

References

Read the full report for CVE-2026-54347 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)