CVE-2026-100717
Deferred Deferred - Pending Action

HTTP Header Injection in Froxlor Admin Panel

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2. An authenticated low-privilege customer with subdomain-create rights (no admin or change_serversettings privilege required) can supply a subdomain redirect URL that carries a CR/LF payload in the userinfo portion (e.g. http://user%0areturn 200 "pwned";%0a@evil.com/). The value passes validation, survives IDNA encoding, and is written verbatim into the generated nginx or Apache vhost configuration, allowing the attacker to break out of the emitted directive and inject arbitrary web-server configuration lines. froxlor regenerates and reloads the web-server configuration as root, so the injected directives take effect server-wide and can hijack responses or read local files. The issue is fixed in version 2.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100717
EUVD
EUVD-2026-87690

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
froxlor froxlor to 2.3.12 (exc)
froxlor froxlor 2.3.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a CRLF (Carriage Return Line Feed) injection flaw in froxlor versions 2.3.10 and earlier. The validateUrl function fails to check for CR/LF characters in the userinfo component (user:pass@) of a URL, only inspecting path, query, and fragment parts. An authenticated low-privilege user with subdomain creation rights can exploit this by injecting CR/LF payloads into the userinfo section of a redirect URL. The payload bypasses validation, survives encoding, and is written directly into the web server configuration (nginx or Apache) during regeneration. Since froxlor reloads the config as root, the attacker can inject arbitrary directives server-wide, enabling response hijacking or local file access.

The issue was fixed in version 2.3.12.

Detection Guidance

Check Froxlor version with: froxlor --version or grep version in Froxlor files. Inspect vhost configurations for injected directives like malicious response headers or file includes. Monitor web server logs for unusual activity or unauthorized changes.

Impact Analysis

An attacker with low-privilege access could inject malicious web server configuration lines, allowing them to hijack server responses or read local files. This could lead to data theft, unauthorized access, or disruption of services. The impact is server-wide due to root-level configuration reloads.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised data integrity and confidentiality.

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Remove low-privilege user subdomain creation rights if not required. Review and sanitize all redirect URLs in Froxlor configuration. Regenerate and reload web server configurations after updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart