What’s Vulnerable › Vulnerabilities

CVE-2026-90937: froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-23
• Weakness: CWE-93

Description

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

Affected products

• froxlor: before 2.2.5 — fixed in 2.2.5

How to fix

Upgrade to a fixed version: froxlor 2.2.5. Check the vendor advisory for mitigations.

References

• https://github.com/froxlor/froxlor/security/advisories/GHSA-c3p2-mj7v-5mrc
• https://www.vulncheck.com/advisories/froxlor-before-2.2.5-nginx-apache-configuration-injection-via-subdomain-redirect-url

Get alerted when CVE-2026-90937 or the next vulnerability affects your stack