Vulnerability in Froxlor
CVE-2026-90937
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.
Vulnerability class: CRLF Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.005 (39.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/froxlor/froxlor/security/advisories/GHSA-c3p2-mj7v-5mrc (vendor-advisory)
- www.vulncheck.com/advisories/froxlor-before-2.2.5-nginx-apache-configuration-in… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-90937?
- CVE-2026-90937 is a critical-severity vulnerability in Froxlor, classified under CRLF Injection. CVSS score: 9.9/10. Published 2026-09-14.
- How severe is CVE-2026-90937?
- Critical severity. CVSS v3 base score is 9.9 out of 10.