Froxlor, an open‑source server administration platform, contained a newline‑injection flaw in the DomainZones.add API that allowed an authenticated user with DNS editing privileges to insert line breaks into the text of a TXT record. The injected line breaks break the normal BIND zone file format, permitting the user to embed arbitrary BIND directives such as $INCLUDE and $GENERATE as well as new DNS resource records (e.g., A, MX, CNAME). In the context of the DNS rebuild cron, this results in a modified zone file written to disk, effectively allowing the user to alter the authoritative DNS data for the domain, which can lead to spoofing, redirecting, or denial of service of legitimate DNS resolution requests.

The vulnerability applies to all Froxlor installations running a version earlier than 2.3.7. The affected product is the Froxlor server administration software. Users should verify the version of Froxlor they are running and plan to upgrade to 2.3.7 or later to receive the patch that sanitizes TXT record content.

The CVSS score of 7.6 indicates high severity. Because the exploit requires an authenticated customer with DNS editing enabled, the attack vector is internal, but the impact on DNS integrity could have widespread consequences for the domain’s clients and services. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Correcting the elimination of newline characters prevents manipulation of zone files and mitigates the risk of DNS injection.