Froxlor CVE-2026-109961

Requires a valid authenticated Froxlor customer account (PR:L) with access to the Ftps.add API, and the host must be deployed with the libnss-extrausers backend where the REBUILD_NSSUSERS cron job regenerates /var/lib/extrausers/group from Froxlor-managed data. The concrete prerequisite is the unvalidated additional_members parameter of Ftps.add accepting embedded newline characters; the privilege-escalation payload is only realized when the REBUILD_NSSUSERS cron subsequently writes the entries unsanitized. Limiting factors: exploitation is gated by customer-level authentication (not anonymous), is only impactful on hosts using the extrausers NSS group database with the rebuild cron enabled, and requires local access to the target host to cash in the newly granted privileged group membership for actual root escalation.

This is a credible, moderately high-priority issue for Froxlor operators, but not an internet-wide emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates the initial injection is reachable over the network with low attack complexity, but it explicitly requires PR:L - a valid authenticated customer account - so it is not an unauthenticated mass-exploitation primitive. The real severity comes from the impact chain: integrity-high on both the vulnerable web application and the subsequent OS-level system (VI:H/SI:H), because injected newlines land unsanitized in the root-owned /var/lib/extrausers/group file and yield local privilege escalation toward root. Confidentiality impact is nil (VC:N/SC:N), consistent with a write/injection flaw rather than data disclosure. No EPSS score, no CISA KEV listing, and no POC flag are present in the supplied data, so there is no evidence of active exploitation or published exploit code - exploitation status is therefore 'no public exploit identified at time of analysis'. Net assessment: a genuine privilege-escalation bug warranting prompt patching on multi-tenant Froxlor hosts (where low-trust customers exist by design), but of limited mass-scanning concern given the authentication requirement and the niche deployment footprint. Missing data to note: no EPSS and no KEV signal were supplied, so exploitation probability cannot be quantified from the input.

A low-privileged but authenticated Froxlor customer calls the Ftps.add API and supplies an additional_members value containing embedded newline characters that encode an extra NSS group line granting their local account membership in a privileged group. When the REBUILD_NSSUSERS cron job next runs, it writes the attacker-controlled line verbatim into the root-owned /var/lib/extrausers/group, and the attacker then leverages that group membership to escalate privileges on the host. No public exploit code is identified in the provided data, so this scenario is inferred from the vulnerability description and CVSS integrity impact.