A critical (CVSS 9.9) CRLF-style injection flaw in Froxlor before 2.2.5 lets authenticated customers write arbitrary nginx or Apache directives into generated vhost configuration files.
What Is It
Froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs. An authenticated customer can supply a redirect URL containing literal newlines, which is written verbatim into vhost config files when the cron job rebuilds the web server configuration. The result is arbitrary injection of nginx or Apache configuration directives. The flaw is tracked as CWE-93 (Improper Neutralization of CRLF Sequences).
Why It Matters
The CNA, VulnCheck ([email protected]), scores the issue at a CVSS 3.1 base score of 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. A secondary CVSS 4.0 score of 9.4 (CRITICAL) is also recorded by the CNA. NVD has not published its own analysis of this record, so both scores are CNA-supplied rather than NVD-assigned. Attack vector is network, attack complexity is low, no user interaction is required, and only low privileges, an ordinary customer account on the panel, are needed. Scope is marked Changed, reflecting that injected directives escape the attacker's own tenancy.
Per the advisory description, successful exploitation enables web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains. On shared hosting, that means one low-privileged customer can affect domains belonging to other tenants on the same server.
A search of the CISA Known Exploited Vulnerabilities catalog on 2026-09-14 returned no entry for CVE-2026-90937, so active exploitation is not confirmed and no federal remediation deadline applies as of that date. Readers can re-check the catalog directly at the link below, since KEV is updated on a rolling basis and this status may change. The CNA's CVSS 4.0 exploit maturity is Not Defined.
What's Vulnerable
- Vendor/product: froxlor / froxlor
- Affected: all versions from 0 up to (but not including) 2.2.5
- Unaffected: 2.2.5 and later
The vulnerable path is the subdomain redirect URL field, processed during cron-driven vhost rebuild.
Patch Status
Froxlor 2.2.5 resolves the issue and is explicitly listed as unaffected. Operators running any earlier release should upgrade to 2.2.5 or later. The CVE was published 2026-09-14 and the NVD record currently carries a vulnStatus of "Received," meaning NVD enrichment is still pending; no CPE match data is available yet, and the NVD entry may gain independent scoring or additional references later. The record was assigned by VulnCheck.
Sources
- NVD entry for CVE-2026-90937; https://nvd.nist.gov/vuln/detail/CVE-2026-90937
- Froxlor GitHub Security Advisory GHSA-c3p2-mj7v-5mrc; https://github.com/froxlor/froxlor/security/advisories/GHSA-c3p2-mj7v-5mrc
- VulnCheck Advisory: Froxlor before 2.2.5 nginx/Apache configuration injection via subdomain redirect URL, https://www.vulncheck.com/advisories/froxlor-before-2.2.5-nginx-apache-configuration-injection-via-subdomain-redirect-url
- CISA Known Exploited Vulnerabilities Catalog (searchable, updated continuously), https://www.cisa.gov/known-exploited-vulnerabilities-catalog