Froxlor EUVD-2026-87693

Requires an authenticated Froxlor customer account (the lowest-privileged role) with the ability to upload an SSL certificate for a domain they own - the injection point is the certificate's issuer organization (issuer['O']) field parsed by openssl_x509_parse() in the Certificates API add()/update() methods. Execution is gated on a privileged victim: an administrator or reseller must open the Domains > SSL certificates listing page, where Twig's raw filter renders the stored value without auto-escaping (UI:P). Affects Froxlor 2.0.0 through 2.3.10; not exploitable on 2.3.12+. Limiting factors: attacker needs a valid tenant account, the payload only fires on admin/reseller interaction, and the root-command-execution escalation depends on the standard Froxlor config-apply cron running as root.

This is a genuine priority within its deployment niche, though not a mass-exploitation emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, score 9.3) reflects a low-complexity network-reachable stored XSS that crosses a privilege boundary (SC:H/SI:H = subsequent-system high impact), and the CVSS 3.1 equivalent would carry Scope:Changed with C:H/I:H. Two signals temper the raw score: exploitation requires an authenticated customer account (PR:L) to inject the payload AND requires a privileged admin/reseller to open the SSL certificates page (UI:P), so it is not fire-and-forget. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - this reads as a targeted, victim-interaction-gated flaw rather than a widespread wormable one. The patch (2.3.12) and a coordinated GitHub Security Advisory from the vendor plus VulnCheck are confirmed, which is the strongest positive signal that the technical root cause is real and fixed. Net: real risk for anyone running multi-tenant Froxlor (the customer→admin→root escalation chain is severe), but the requirement for both a foothold account and admin interaction keeps real-world likelihood moderate rather than critical.

A low-privileged Froxlor customer uploads a crafted SSL certificate for one of their own domains whose issuer organization field (issuer['O']) contains an HTML/JavaScript payload; openssl_x509_parse() extracts it and the API stores it verbatim. When an administrator or reseller later opens Domains > SSL certificates, the Twig raw filter emits the value unescaped and the script runs in the privileged session, enabling account takeover and - via Froxlor's root cron that applies webserver/DNS/PHP config - potential command execution as root. No public POC or exploit code was identified at time of analysis.