Skip to main content

Froxlor EUVDEUVD-2026-77455

| CVE-2026-90937 CRITICAL
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-09-14 disclosure@vulncheck.com GHSA-r2fc-pw6p-x28w
Denial Of Service Apache Nginx Froxlor
9.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Authenticated customer (PR:L) injects config affecting other tenants' domains, so scope changes (S:C) with high cross-domain confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Metadata Corrected
Sep 15, 2026 - 08:40 vuln.today
tag: Froxlor added
Analysis Generated
Sep 15, 2026 - 08:17 vuln.today
Patch available
Sep 14, 2026 - 14:17 EUVD
CVE Published
Sep 14, 2026 - 13:19 cve.org
CRITICAL 9.4

DescriptionCVE.org

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

Articles & Coverage 1

News We need answer only title. Need understand vulnerability. CVE-2026-90937. Product: Nginx? Severity critical. Summary says configuration injection in Froxlor hosting control panel (all versions before 2.2.5) lets authenticated customer embed literal newline chars in subdomain redirect URL, written verbatim into nginx or Apache vhost config files when privileged cron rebuilds. So product maybe Froxlor, but given Product: Nginx. Title format "Critical/High [Vulnerability Type] in [Product] - [CVE-ID]". Need Sep 15, 2026

AnalysisAI

Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated Froxlor customer account (PR:L) with permission to create or edit a subdomain and set its redirect URL - the exact injection vector is a subdomain redirect URL field that accepts literal newline characters. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 score of 9.4 (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L) reflects a network-reachable, low-complexity flaw requiring only a valid customer login and no user interaction - a realistic bar in shared-hosting environments where customer accounts are sold or self-registered. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Froxlor 2.2.5 or later, which validates and rejects newline characters in subdomain redirect URLs (Vendor-released patch: 2.2.5, per GHSA-c3p2-mj7v-5mrc). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Froxlor deployments and their current versions; notify customers if you operate shared hosting using affected versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Froxlor

View all
CVE-2023-0315 HIGH POC
8.8 Jan 16

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. Rated high severity (CVSS 8.8), this vulnerabilit
CVE-2023-3173 CRITICAL POC
9.8 Jun 09

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. Rated cr
CVE-2023-1307 CRITICAL POC
9.8 Mar 10

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. Rated critical severity

CVE-2021-42325 CRITICAL POC
9.8 Oct 12

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. Rated critic
CVE-2026-26279 CRITICAL POC
9.1 Mar 03

Command injection in Froxlor server admin before 2.3.4 due to typo (== instead of =) disabling input validation entirely
CVE-2023-6069 HIGH POC
8.8 Nov 10

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. Rated high severity (CV
CVE-2023-2034 HIGH POC
8.8 Apr 14

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. Rated high severit
CVE-2023-1033 HIGH POC
8.8 Feb 25

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8),

CVE-2023-0877 HIGH POC
8.8 Feb 17

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability

CVE-2023-0671 HIGH POC
8.8 Feb 04

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 8.8), this vulnerability

CVE-2020-10235 HIGH POC
8.8 Mar 09

An issue was discovered in Froxlor before 0.10.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2023-50256 HIGH POC
7.5 Jan 03

Froxlor is open source server administration software. Rated high severity (CVSS 7.5), this vulnerability is remotely ex

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2026-84372 CRITICAL POC
9.8
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-54511 HIGH POC
8.6
CVE-2026-70615 HIGH POC
8.5
CVE-2024-45302 HIGH POC
7.8
CVE-2017-5868 MEDIUM POC
6.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-77455 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy