by Kastro
Paper/Archive/CVE-2026-90937

CVE-2026-90937

froxlor froxlor — froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 39.2.392 × 207.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

Affected

ProductAffectedFixed inSource
froxlor< 2.2.52.2.5CNA

Scores by source

VulnCheck (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/froxlor/froxlor/security/advisories/GHSA-c3p2-mj7v-5mrcwriteupvulncheck.com/advisories/froxlor-before-2.2.5-nginx-apache-configuration-injection-via-subdomain-redirect-url