CVE-2026-90937

CRITICAL 9.9

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

CWE	CWE-93
Vendor	froxlor
Product	froxlor
Published	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new critical vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

froxlor / froxlor

0 < 2.2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-c3p2-mj7v-5mrc vulncheck.com: https://www.vulncheck.com/advisories/froxlor-before-2.2.5-nginx-apache-configuration-injection-via-subdomain-redirect-url

Credits

🔍 aslein1413-sys