EUVD-2026-77455
GHSA-r2fc-pw6p-x28w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated customer (PR:L) injects config affecting other tenants' domains, so scope changes (S:C) with high cross-domain confidentiality, integrity, and availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.
AnalysisAI
Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Froxlor customer account (PR:L) with permission to create or edit a subdomain and set its redirect URL - the exact injection vector is a subdomain redirect URL field that accepts literal newline characters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 9.4 (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L) reflects a network-reachable, low-complexity flaw requiring only a valid customer login and no user interaction - a realistic bar in shared-hosting environments where customer accounts are sold or self-registered. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Froxlor 2.2.5 or later, which validates and rejects newline characters in subdomain redirect URLs (Vendor-released patch: 2.2.5, per GHSA-c3p2-mj7v-5mrc). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Froxlor deployments and their current versions; notify customers if you operate shared hosting using affected versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. Rated high severity (CVSS 8.8), this vulnerabilit
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. Rated cr
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. Rated critical severity
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. Rated critic
Command injection in Froxlor server admin before 2.3.4 due to typo (== instead of =) disabling input validation entirely
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. Rated high severity (CV
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. Rated high severit
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8),
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 8.8), this vulnerability
An issue was discovered in Froxlor before 0.10.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
Froxlor is open source server administration software. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today