Froxlor CVE-2026-90937

Requires an authenticated Froxlor customer account (PR:L) with permission to create or edit a subdomain and set its redirect URL - the exact injection vector is a subdomain redirect URL field that accepts literal newline characters. Exploitation depends on the server running the Froxlor cron job that regenerates Apache or nginx vhost config files (default behavior), and impact realizes only after that rebuild runs, so there is a timing dependency rather than instantaneous execution. Limiting factors: the attacker must already have a valid customer login, and multi-tenant impact is only meaningful on shared servers hosting multiple domains; single-tenant/self-hosted installs limit the blast radius to the operator's own domains.

The vendor CVSS 4.0 score of 9.4 (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L) reflects a network-reachable, low-complexity flaw requiring only a valid customer login and no user interaction - a realistic bar in shared-hosting environments where customer accounts are sold or self-registered. The high vulnerable- and subsequent-system confidentiality/integrity metrics correctly capture cross-tenant compromise, while availability is rated lower (VA:L/SA:L) because a broken config primarily degrades service rather than destroying data. No EPSS score, KEV entry, or public POC was provided, so exploitation probability signals are absent; the score is driven by impact and ease, not by observed activity. The main limiting factor is the authentication requirement (PR:L) and the timing dependency on the cron-driven config rebuild - exploitation is not instantaneous but is reliable. This is a genuine priority for anyone running multi-tenant Froxlor, and lower urgency for single-operator deployments where the attacker would already be trusted.

A low-privileged customer on a shared Froxlor server creates a subdomain with a redirect URL whose value contains literal newline characters followed by attacker-chosen nginx/Apache directives. When the privileged cron job next rebuilds the vhost configuration, the injected directives are written verbatim and loaded by the web server, letting the attacker hijack or break HTTP handling for other domains hosted on the same box. No public exploit code was identified at time of analysis.