Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.
References
| Link | Resource |
|---|---|
| https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c | Exploit Mitigation Vendor Advisory |
| https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343 | Patch |
| https://github.com/froxlor/froxlor/releases/tag/2.3.4 | Release Notes |
Configurations
History
05 Mar 2026, 21:19
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* | |
| First Time |
Froxlor
Froxlor froxlor |
|
| References | () https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c - Exploit, Mitigation, Vendor Advisory | |
| References | () https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343 - Patch | |
| References | () https://github.com/froxlor/froxlor/releases/tag/2.3.4 - Release Notes |
03 Mar 2026, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-03 23:15
Updated : 2026-03-05 21:19
NVD link : CVE-2026-26279
Mitre link : CVE-2026-26279
CVE.ORG link : CVE-2026-26279
JSON object : View
Products Affected
froxlor
- froxlor