← Back to the live CVE advisory feed

CVE-2026-100720: froxlor

Severity

9.3 (CRITICAL)

Vendor

FROXLOR

Affected versions

2.0.0 through before 2.3.12

Fixed version

2.3.12

Patch status

Patched

Published

2026-09-26T14:16:58.230

Modified

2026-09-26T14:16:58.340

Why it matters

Critical vulnerability requiring immediate validation against your environment.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.

View the official NVD record for CVE-2026-100720

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.