CVE-2026-90937
Received Received - Intake

froxlor Subdomain Redirect Newline Injection Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90937
EUVD
EUVD-2026-77455

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor to 2.2.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90937 is a CRLF injection flaw in froxlor versions before 2.2.5. Authenticated users can inject arbitrary nginx or Apache configuration directives via subdomain redirect URLs containing newline characters. The software fails to validate these newlines, allowing malicious URLs to corrupt web server configurations during cron rebuilds.

Detection Guidance

Check froxlor version with 'froxlor --version' or via the web interface. Inspect nginx/Apache config files for unexpected directives or corrupted vhost configurations. Look for subdomain redirect URLs containing newline characters in logs or database entries.

Impact Analysis
  • Corruption of web server configurations for hosted domains.
  • Denial of service due to failed configuration reloads.
  • Hijacking of HTTP responses across domains.
  • Exposure of sensitive files like /etc/passwd or SSL private keys.
Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Upgrade froxlor to version 2.2.5 or later immediately. Review and remove any suspicious subdomain redirect URLs containing newline characters. Restrict customer access to subdomain creation/modification until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90937. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart