Froxlor 2.0.0 through 2.3.10 is affected by a stored cross-site scripting vulnerability (CVE-2026-100720). The flaw arises because the Certificates API add()/update() methods parse SSL certificates and store the issuer organization (issuer['O']) field without sanitization. The table-listing renderer emits this data using Twig's `raw` filter, disabling HTML auto-escaping. Consequently, when an administrator or reseller views the SSL certificates page, attacker-controlled script executes in their session. This crosses privilege boundaries from a low-privileged customer to high-privileged users, enabling full admin account takeover. Given that Froxlor admins control critical server configurations and a root-level cron job applies these configurations, the vulnerability can escalate to root command execution. The vulnerability is fixed in Froxlor 2.3.12.

Successful exploitation allows a low-privileged customer to execute arbitrary script in the context of administrators or resellers, leading to full administrator account compromise. Since administrators control webserver, DNS, and PHP configurations applied with root privileges, attackers can escalate to root command execution on the server. This represents a critical security risk with high confidentiality and integrity impact but no direct availability impact.

Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.