Froxlor before version 2.3.12 does not properly restrict or escape the system.letsencryptchallengepath setting. Unlike other similar settings hardened in GHSA-33mp, this field lacks string_regexp or required_otp guards. Its value is concatenated unescaped into the acme.sh command line in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by root cron via FileDir::safe_exec. The safe_exec function blacklists certain shell metacharacters but allows spaces and quotes, enabling word splitting into additional acme.sh arguments. An attacker with permission to write settings (e.g., through the settings-import API) can inject options like --renew-hook, --pre-hook, or --post-hook to execute arbitrary commands as root during the next Let's Encrypt cron run, or use --config-home/--cert-home for arbitrary file writes. Versions up to and including 2.3.10 are affected; the vulnerability is fixed in 2.3.12.

An attacker with the ability to modify Froxlor settings can achieve arbitrary command execution as root or arbitrary file writes on the affected system. This can lead to full system compromise, data loss, or persistent unauthorized access. The vulnerability is critical with a CVSS score of 9.1, reflecting high impact on confidentiality, integrity, and availability.

Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. Until then, restrict access to the settings-import API and any administrative interfaces that allow modification of the system.letsencryptchallengepath setting to trusted users only. Monitor for unauthorized changes to settings. Patch status is confirmed fixed in 2.3.12.