CVE-2026-90937

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

State: Published
Severity: 9.4 Critical
Published: Sep 14, 2026
Updated: Sep 16, 2026
Reserved: Sep 14, 2026

Description

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L	VulnCheck
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L	VulnCheck

Weaknesses

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

Product	Versions
froxlorfroxlor	before 2.2.5Affected 2.2.5Not affected

References

GitHub Security Advisory (GHSA-c3p2-mj7v-5mrc)vendor-advisory
VulnCheck Advisory: froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.