Configuration Injection Vulnerability in Froxlor Web Hosting Management Software
CVE-2026-90937

9.4CRITICAL

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90937?

Froxlor versions before 2.2.5 are susceptible to a vulnerability that allows authenticated users to inject arbitrary nginx or Apache configuration directives through unvalidated newline characters in subdomain redirect URLs. This flaw can lead to the unauthorized manipulation of vhost configuration files during cron rebuild processes. Consequently, attackers may exploit this vulnerability to corrupt web server configurations, potentially causing denial of service or hijacking HTTP responses across multiple hosted domains.

Affected Version(s)

froxlor 0 < 2.2.5

froxlor 2.2.5

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/froxlor-before-2.2.5...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

aslein1413-sys
.