by Kastro
Paper/Archive/CVE-2026-26279

CVE-2026-26279

froxlor Froxlor — Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 60.7.607 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.

Affected

ProductAffectedFixed inSource
Froxlor< 2.3.4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7crefgithub.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343refgithub.com/froxlor/froxlor/releases/tag/2.3.4