CVE-2026-54543 is a medium-severity (CVSS 5.4) CWE-74 vulnerability in froxlor/froxlor. O3 Security confirms whether CVE-2026-54543 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-54543.
Real-World Exposure
froxlor/froxlorReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.
The stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:
www\t60\tIN\tA\t6.6.6.6 ;\n@
with type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\Dns\DnsEntry::__toString() sink renders it as:
www 60 in a 6.6.6.6 ; @ 18000 IN A 127.0.0.1
BIND accepts the generated zone file:
named-checkzone example.com froxlor_dns_record_injected.zone zone example.com/IN: loaded serial 2026060501 OK
named-compilezone -D confirms both records are parsed as real DNS RRs:
example.com. 18000 IN A 127.0.0.1 www.example.com. 60 IN A 6.6.6.6 zone example.com/IN: loaded serial 2026060501 OK
Affected code in 2.3.7:
- lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.
- lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.
- lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.
- lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.
- lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.
- lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.
There is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\tns.\n@\tA renders one submitted entry as multiple zone-file records.
Impact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.
Suggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.
Attribution: Yaohui Wang.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | froxlor/froxlor | all versions | 2.3.8 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for froxlor/froxlor. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update froxlor/froxlor to 2.3.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54543 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-54543 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-54543. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-54543 in your dependencies?
O3 detects CVE-2026-54543 across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.