CVE-2026-90767

Deferred Deferred - Pending Action

Froxlor SSH Public Key Injection Leading to Unauthorized Access

Publication date: 2026-09-13

Last updated on: 2026-09-23

Assigner: VulnCheck

Description

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-23

Generated

2026-10-03

AI Q&A

2026-09-13

EPSS Evaluated

2026-10-02

NVD

CVE-2026-90767

EUVD

EUVD-2026-76988

Affected Vendors & Products

Vendor	Product	Version / Range
froxlor	froxlor	to 2.3.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

Froxlor before version 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint. This allows attackers to inject arbitrary lines into authorized_keys files by exploiting newline characters in the input. The system treats subsequent lines as comments, enabling the addition of malicious SSH key entries with option directives like command="...". These injected entries persist even after key deletion or SSH access revocation, granting unauthorized persistent access.

Detection Guidance

Check Froxlor versions below 2.3.12 by running: froxlor --version. Inspect authorized_keys files in user home directories for unexpected multi-line entries or malicious options like command="...". Use grep to search for froxlor:id= comments in ~/.ssh/authorized_keys files.

Impact Analysis

This vulnerability allows attackers with SSH access to gain persistent unauthorized access to your account. They can inject malicious SSH key entries that survive key deletion or SSH access revocation. The impact is limited to the attacker's own account but results in unauthorized persistence and integrity issues in the authorized_keys file.

Compliance Impact

This vulnerability could lead to unauthorized persistent access to systems, potentially violating data confidentiality and integrity requirements under GDPR and HIPAA. Unauthorized SSH access may result in unauthorized data access, modification, or exfiltration, which are direct violations of these regulations.

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Review and manually clean all authorized_keys files for injected entries. Disable SSH access for affected users until verification. Monitor for unauthorized persistence.

Hi! I’m here to help you understand CVE-2026-90767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70