CVE-2026-100720
Deferred Deferred - Pending Action

Stored XSS in Froxlor Admin Panel via SSL Certificate Issuer

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100720
EUVD
EUVD-2026-87693

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
froxlor froxlor From 2.0.0 (inc) to 2.3.10 (inc)
froxlor froxlor 2.3.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Froxlor versions 2.0.0 through 2.3.10. A low-privileged customer can upload an SSL certificate with a malicious issuer organization field. When an admin or reseller views the SSL certificates list, the unsanitized issuer value executes as script in their session due to raw HTML rendering.

Detection Guidance

To detect this vulnerability, check if your Froxlor version is between 2.0.0 and 2.3.10. Run: froxlor --version. If the version is within this range, the system is vulnerable. Additionally, inspect SSL certificate issuer fields in the Froxlor admin panel for unexpected scripts or HTML tags.

Impact Analysis

The vulnerability allows privilege escalation from customer to admin, leading to full account takeover. Since Froxlor admins control server configurations, it can further escalate to root-level command execution on the managed server.

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. If upgrading is not possible, disable the Certificates API add()/update() methods or implement input sanitization for the issuer organization field. Remove any suspicious SSL certificates uploaded by customers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart