Read the docs
TI-2026-21248 Aliases CVE-2026-26279GHSA-33mp-8p67-xj7c

Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Priority MEDIUM 43CWE-482Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00931 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Froxlor (froxlor): 2.3.4froxlor/froxlor (Packagist): 2.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
froxlorFroxlorbefore 2.3.42.3.4Patch availableCNA
—froxlor/froxlor (Packagist)before 2.3.42.3.4Patch availableGHSA-33mp-8p67-xj7c
  • Froxlor Vendorfroxlor Affected before 2.3.4 Fixed in 2.3.4 Patch available CNA
  • froxlor/froxlor (Packagist) Vendor— Affected before 2.3.4 Fixed in 2.3.4 Patch available GHSA-33mp-8p67-xj7c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*before 2.3.4Vulnerablefroxlor
  • cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* Versions before 2.3.4 Vulnerable ·froxlor

Remediation

  • Fix · CNA Froxlor (froxlor) Fixed in 2.3.4
  • Fix · GHSA-33mp-8p67-xj7c froxlor/froxlor (Packagist) Fixed in 2.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26279
  2. 2026-10-03 Alias added: GHSA-33mp-8p67-xj7c

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-00300 Command Injection in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2023-02973 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01234 Authentication Bypass by Primary Weakness in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01911 Unrestricted Upload of File with Dangerous Type in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2026-29837 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-29838 Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) CVSS 3.1CRITICAL 9.1
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences