Froxlor CVE-2026-100714

Requires the ability to write the system.letsencryptchallengepath setting - i.e. an authenticated Froxlor administrator, or any actor able to reach the settings-import API - AND the Let's Encrypt / acme.sh cron path must be active (letsencrypt configured) so the root cron executes the poisoned command line. Unlike sibling settings hardened in GHSA-33mp, this field has no string_regexp or required_otp guard. Exploitation is limited by: the PR:H authentication requirement (panel admin / settings-write), the delay until the next Let's Encrypt cron run, and the need for acme.sh-based certificate issuance to be in use. The safe_exec metacharacter blacklist (; | & > < \ $ ~ ?) does NOT block spaces or quotes, which is what makes argument injection possible.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H with subsequent-system SC:H/SI:H/SA:H, 9.4) is well-justified for the technical impact: successful exploitation yields arbitrary command execution as root at the next Let's Encrypt cron run. The PR:H metric is the key limiter - the primary actor is an authenticated Froxlor administrator, or any principal able to write settings (e.g. via the settings-import API), so this is not a remote-unauthenticated flaw despite AV:N. The most significant real-world signal is the privilege-boundary crossing: a panel administrator (who is NOT necessarily a root shell operator) escalates to full root code execution on the host, which justifies treating the subsequent-system impacts (and a scope change in 3.1 terms) as High. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced; the only sources are the vendor GHSA advisory and VulnCheck. This is therefore a genuinely high-technical-impact issue (root RCE) but its real-world urgency is tempered by the administrative/settings-write precondition and the absence of any exploitation evidence. It is a real priority for Froxlor operators to patch, but not an actively-exploited emergency.

An authenticated Froxlor administrator (or an actor who can reach the settings-import API) sets system.letsencryptchallengepath to a value containing space-separated acme.sh options such as '--pre-hook "id>/tmp/x"' or '--post-hook'. Because safe_exec only blacklists metacharacters like ; | & $ and not spaces or quotes, the value is word-split into extra acme.sh arguments and executed by the root cron at the next Let's Encrypt run, giving arbitrary command execution as root; --config-home/--cert-home can alternatively be injected for arbitrary root file writes. No public exploit code is currently identified.