DomainZones::add accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the content field. When a non‑validated type is submitted, content validation is bypassed and embedded newlines are stored and later written directly into BIND zone files via DnsEntry::__toString(). An authenticated customer can inject arbitrary DNS records and BIND directives ($INCLUDE, $ORIGIN, $GENERATE), allowing the attacker to alter DNS zone configuration, redirect traffic, or disrupt service.

Froxlor server administration software versions earlier than 2.3.6 running on any server where customers can access the domain zone management interface. All installations of froxlor less than 2.3.6 are affected.

The CVSS score of 8.5 marks this as high severity. EPSS is under 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated web user with domain administrator rights submitting crafted DNS record types through the administration interface; because content is not sanitized, newline characters survive and are written into zone files, giving an attacker the power to inject BIND directives.