CVE-2024-58383 is a vulnerability in Froxlor versions up to and including 2.2.0-rc3 where the file /etc/pure-ftpd/db/mysql.conf is created with insecure permissions (0644). This file contains the Froxlor SQL user's password, allowing any unprivileged local user with code execution capabilities to read it. Exploiting this, an attacker can access the database, modify administrator credentials, and escalate privileges to root. Only Froxlor instances configured to use pure-ftpd are affected.
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
CVE-2026-55593 is a Cross-Site Request Forgery (CSRF) vulnerability in Froxlor server administration software versions prior to 2.3.8. The vulnerability exists because the ajax.php endpoint bypasses centralized request validation and does not require a CSRF token for certain state-changing actions. An unauthenticated attacker can trick an authenticated administrator into submitting a forged request that modifies API key restrictions, such as allowed IP addresses or expiration times, weakening security controls. This issue is fixed in Froxlor version 2.3.8.
CVE-2026-54347 is a high-severity cross-site scripting (XSS) vulnerability in Froxlor server administration software versions prior to 2.3.8. An authenticated customer with DNS editor access can inject JavaScript code into DNS TXT records. When an administrator views the affected domain's DNS configuration, the malicious script executes in the administrator's browser, potentially exposing session data or allowing privileged actions. The vulnerability is fixed in Froxlor version 2.3.8.
CVE-2026-54348 is a SQL Injection vulnerability in Froxlor server administration software versions prior to 2.3.8. Authenticated administrators with change_serversettings permission can inject malicious SQL via the Admins.add and Admins.update endpoints by supplying a crafted ipaddress array. This leads to unsafe SQL query construction in IpsAndPorts.listing and Domains.php, allowing retrieval of sensitive database data including admin login names and password hashes. The issue is fixed in version 2.3.8.
CVE-2026-54543 is an injection vulnerability in Froxlor server administration software versions prior to 2.3.8. The DomainZones.add API command improperly accepts user-controlled record and type values containing line delimiters, tabs, semicolons, or unsupported DNS record types. This allows an authenticated user with DNS-zone permissions to inject additional resource-record lines into BIND zone files, potentially modifying DNS data and impacting DNS availability within authorized zones. The issue is fixed in Froxlor version 2.3.8.
CVE-2026-62988 is a critical vulnerability in Froxlor server administration software versions prior to 2.3.8. Certain API commands exposed full database rows including password hashes and Base32-encoded TOTP seeds without redaction. An authenticated user with API access can retrieve sensitive credentials and two-factor authentication secrets, enabling potential account takeover. The issue is fixed in version 2.3.8.
CVE-2026-52793 is an authentication bypass vulnerability in Froxlor server administration software prior to version 2.3.7. The API authentication mechanism does not enforce two-factor authentication (2FA) for accounts that have 2FA enabled on the web interface, allowing attackers with valid API credentials to bypass the second factor. This can lead to unauthorized access to sensitive customer data and administrative functions via the API. The issue is fixed in Froxlor version 2.3.7.
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.