SSH Key Injection Vulnerability in Froxlor by Froxlor

CVE-2026-90767

What is CVE-2026-90767?

Froxlor prior to version 2.3.12 is susceptible to a vulnerability in its handling of multi-line SSH public keys within the SshKeys::add() endpoint. This flaw allows malicious actors to inject arbitrary lines into the authorized_keys files. As a result, attackers can introduce harmful SSH key entries containing option directives, which could facilitate persistent unauthorized access—making it possible for the intrusion to endure beyond key deletion or revocation of SSH access. This vulnerability creates significant security risks and undermines the control users have over their SSH access configurations.

References