Skip to content
OpenAdvisories
High WID-SEC-2026-3200 14 CVEs

Froxlor: Mehrere Schwachstellen

Published Sep 6, 2026 · Updated Sep 27, 2026 · Revision 3 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um Administratorrechte zu erlangen, um Daten zu manipulieren oder offenzulegen, sowie um Sicherheitsmechanismen zu umgehen.

Product

Froxlor ist eine Web-basierte Server-Management-Software.

Vulnerabilities 14

  • Critical 9.9
    CVE-2026-100716

    Froxlor before 2.3.12 Privilege Escalation via Symlink

    Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-c…

    froxlor froxlor
  • Critical 9.9
    CVE-2026-100717

    froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

    froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@…

    froxlor froxlor
  • Critical 9.6
    CVE-2026-100715

    Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

    Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, …

    froxlor froxlor
  • Critical 9.1
    CVE-2026-100714

    Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

    Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh comman…

    froxlor froxlor
  • High 8.7
    CVE-2026-100720

    Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

    Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x5…

    froxlor froxlor
  • High 7.8
    CVE-2026-100713

    Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

    Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()…

    froxlor froxlor
  • High 7.5
    CVE-2026-100709

    Froxlor before 2.3.11 2FA Bypass via Namespace Confusion

    Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because cu…

    froxlor froxlor
  • High 7.5
    CVE-2026-100711

    froxlor before 2.3.12 Authentication Bypass via Session Persistence

    froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rota…

    froxlor froxlor
  • High 7.1
    CVE-2026-100708

    Froxlor before 2.3.13 Private Key Disclosure via Certificates API

    Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings …

    froxlor froxlor
  • High 7.1
    CVE-2026-100718

    Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

    Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.al…

    froxlor froxlor
  • Medium 6.5
    CVE-2026-100712

    froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

    froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token…

    froxlor froxlor
  • Medium 6.5
    CVE-2026-100719

    Froxlor before 2.3.12 Credential Disclosure via DirProtections API

    Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling o…

    froxlor froxlor
  • Medium 6.5
    CVE-2026-90767

    Froxlor before 2.3.12 SSH Key Injection via authorized_keys

    Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain …

    froxlor froxlor
  • Medium 4.9
    CVE-2026-100710

    Froxlor before 2.3.12 DKIM Private Key Disclosure via API

    Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodif…

    froxlor froxlor

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-100710, EUVD-2026-87683, CVE-2026-100720, EUVD-2026-87693, CVE-2026-100719, EUVD-2026-87692, CVE-2026-100718, EUVD-2026-87691, CVE-2026-100717, EUVD-2026-87690, CVE-2026-100716, EUVD-2026-87689, CVE-2026-100709, EUVD-2026-87682, CVE-2026-100715, EUVD-2026-87688, CVE-2026-100714, EUVD-2026-87687, CVE-2026-100713, EUVD-2026-87686, CVE-2026-100712, EUVD-2026-87685, CVE-2026-100711, EUVD-2026-87684, CVE-2026-100708, EUVD-2026-87681

  2. #2

    Referenz(en) aufgenommen: CVE-2026-90767, EUVD-2026-76988

  3. #1

    Initiale Fassung

References