Skip to content
OpenAdvisories
High WID-SEC-2026-1737 8 CVEs

Froxlor: Mehrere Schwachstellen

Published May 28, 2026 · Updated Sep 14, 2026 · Revision 4 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.

Product

Froxlor ist eine Web-basierte Server-Management-Software.

Vulnerabilities 8

  • Critical 9.8
    CVE-2023-3173

    Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor

    Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • High 8.8
    CVE-2026-41236

    Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

    Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a cu…

    froxlor froxlor froxlor/froxlor Packagist
  • High 8.6
    CVE-2026-41235

    Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

    Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that w…

    froxlor froxlor froxlor/froxlor Packagist
  • High 8.6
    CVE-2026-41237

    Froxlor has an incomplete fix for CVE-2026-30932

    Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators r…

    froxlor froxlor froxlor/froxlor Packagist
  • High 8.1
    CVE-2026-52793

    Froxlor: API Authentication bypasses 2FA Authentication

    Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa,…

    froxlor froxlor froxlor/froxlor Packagist
  • High 7.3
    CVE-2024-58383

    Froxlor before 2.2.0 Insecure File Permissions mysql.conf

    Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the pa…

    froxlor froxlor froxlor/froxlor Packagist
  • Medium 4.3
    CVE-2026-90935

    Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

    Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypass…

    froxlor froxlor froxlor/froxlor Packagist
  • Medium 4.3
    CVE-2026-90936

    Froxlor before 2.3.7 Information Disclosure via customer_email.php

    Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid para…

    froxlor froxlor froxlor/froxlor Packagist

Revision history

  1. #4

    Referenz(en) aufgenommen: CVE-2026-90936, EUVD-2026-77454, CVE-2024-58383, EUVD-2024-55764, CVE-2026-90935, EUVD-2026-77453

  2. #3

    Referenz(en) aufgenommen: CVE-2026-52793, EUVD-2026-61215

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-34314, EUVD-2026-34316, EUVD-2026-34315

  4. #1

    Initiale Fassung

References