Froxlor EUVD-2026-76988

Exploitation requires a valid Froxlor customer account with the SSH keys feature enabled (non-default in minimal installations; must be explicitly provisioned by the hosting provider). The attacker must be able to reach the Froxlor customer API endpoint over the network (AV:N). No additional privileges beyond a standard customer login are needed. Exploitation is limited to installations where: (1) the Froxlor SSH key management module is active and customer accounts have been granted SSH key upload rights, and (2) the SshKeys cron job is scheduled and running. Deployments where SSH key management is disabled or restricted to administrators are not exploitable. The injected persistence survives key deletion only while the poisoned authorized_keys file is not regenerated from a clean baseline.

The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) accurately reflects that exploitation requires a valid low-privilege customer account (PR:L) but no elevated complexity or user interaction. The real-world severity is higher than a raw integrity score suggests: the attacker achieves persistent SSH backdoor access that survives administrative revocation, defeating a primary incident-response control. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified beyond the architectural signal. No CISA KEV listing and no confirmed POC code reduce urgency relative to the worst case. The 'Authentication Bypass' framing in the tags is partially accurate in that injected options can circumvent forced-command restrictions or key revocation, but the root mechanism is injection, not a protocol-level auth bypass. Hosting providers exposing the Froxlor customer SSH-key management feature to shared-hosting tenants face meaningful insider-threat and compromised-account risk.

A shared-hosting customer authenticates to the Froxlor customer portal and submits a crafted SSH public key payload containing an embedded newline followed by a second complete key entry: e.g., 'ssh-ed25519 AAAA...legitkey customer@host\nssh-ed25519 AAAA...attackerkey no-pty,command="/bin/bash" attacker@evil'. The next Froxlor cron run writes the poisoned authorized_keys file to the server. Even after the customer account is suspended and their key deleted, the injected attacker-controlled key entry remains, granting the attacker persistent interactive SSH access to the hosting server.