Newline Injection Vulnerability in Froxlor Product by Froxlor
CVE-2026-109961

8.4HIGH

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109961?

The Froxlor web hosting management panel, specifically versions prior to 2.3.14, is susceptible to a newline injection vulnerability. This flaw allows authenticated users to exploit the unverified 'additional_members' parameter of the Ftps.add API. By embedding newline characters, attackers can manipulate the root-owned NSS group database, resulting in unauthorized group entry creations. Consequently, this could lead to local privilege escalation, compromising system integrity. It is crucial to update to the latest version to mitigate this vulnerability.

Affected Version(s)

froxlor 0.10.0 < 2.3.14

froxlor 2.3.14

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/froxlor-0.10.0-befor...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.