Threats tagged 'ghsa-fh3h-q9pj-x5qp'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.1	EPSS 0.5%	CVE-2026-100714 · Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the Critical9.1EPSS 0.5%2026-09-26GCVE Database Froxlor versions up to and including 2.3.10 have a critical vulnerability where the system.letsencryptchallengepath setting is not properly restricted or escaped. This allows an administrator or any actor able to write settings to inject arbitrary command-line options into the acme.sh command executed by root via cron, leading to arbitrary command execution or file writes as root. The issue is fixed in version 2.3.12. EPSS 0.5%Vulnerability CWE-88 #ghsa-fh3h-q9pj-x5qp	GCVE Database	2026-09-26

Page 1 of 1