A critical CRLF injection flaw in the froxlor server administration panel (CVE-2026-100717, CVSS 3.1: 9.9) lets a low-privilege customer inject arbitrary nginx or Apache configuration directives, which froxlor then applies server-wide as root.
What Is It
CVE-2026-100717 is a CRLF injection weakness (CWE-93) in froxlor's Validate::validateUrl function. The validator rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url. It never checks the userinfo (user:pass@) component. According to the NVD description, this is an incomplete fix for an earlier issue, GHSA-c3p2.
An authenticated customer with subdomain-create rights can supply a subdomain redirect URL with a CR/LF payload in the userinfo portion, for example http://user%0areturn 200 "pwned";%[email protected]/. The URL passes validation, survives IDNA encoding and is written verbatim into the generated nginx or Apache vhost configuration. This lets the attacker break out of the emitted directive and inject arbitrary web-server configuration lines.
Why It Matters
- Low bar to exploit: The attacker needs only customer-level access with subdomain-create rights. No admin or
change_serversettingsprivilege is required. - Server-wide impact: froxlor regenerates and reloads the web-server configuration as root, so injected directives apply to the whole server, not just the attacker's own vhost.
- Consequences: Per the advisory, injected configuration can hijack responses or read local files.
- Scoring: CVSS 3.1 base score is 9.9 (CRITICAL,
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H). CVSS 4.0 base score is 8.5 (HIGH).
This matters most for hosting providers and multi-tenant environments, where customer accounts may not be fully trusted.
Exploitation status: CVE-2026-100717 is not in the supplied CISA KEV data, so KEV does not confirm active exploitation. NVD lists the record as "Deferred."
What's Vulnerable
- Product: froxlor (vendor: froxlor)
- Affected versions: The description says versions 2.3.10 and earlier. The structured affected-version data lists all versions below 2.3.12 as affected.
- Unaffected: 2.3.12 and later
- Configurations affected: froxlor-generated nginx and Apache vhost configurations
Patch Status
The issue is fixed in froxlor 2.3.12. Administrators should upgrade to 2.3.12 or later. Since the flaw lets customers write into web-server configs, operators should also consider reviewing existing subdomain redirect URLs and generated vhost files for unexpected directives. No CISA KEV required action or due date applies because the CVE is not in the supplied KEV data.