QwikSec

Security Database

CVE

CWE

Training

CVE-2026-26279

Published: Mar 3, 2026

Modified: Mar 4, 2026

PUBLISHED

CVSS v3.1

9.1

CRITICAL

Description

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.

Vendor	Product	Versions
froxlor	Froxlor	affected `< 2.3.4`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c

x_refsource_CONFIRM

https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343

x_refsource_MISC

https://github.com/froxlor/froxlor/releases/tag/2.3.4

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.