Froxlor: Newline injection in Ftps.add enables local privilege escalation
Summary
Froxlor versions 0.10.0 up to 2.3.13 do not validate the additional_members parameter of the Ftps.add API. An authenticated customer can insert newline characters, and the REBUILD_NSSUSERS cron job writes them unchanged into the root-owned group file /var/lib/extrausers/group. An attacker can thereby create arbitrary group entries, for example with GID 0, and gain elevated local privileges on the host. The attack requires a valid customer login on the panel, but no administrator privileges.
Affected
- Froxlor 0.10.0 to before 2.3.14 (up to and including 2.3.13)
- Default configuration (nssextrausers=1, FTP functions not hidden for customers)
Fixed in
- Fixed in Froxlor 2.3.14
Workaround
- No workaround published by the vendor.
- Restricting customer access to the FTP functions and checking the group file regularly are not confirmed by the vendor, but reduce the risk.
Exploitation
- No confirmed exploitation in the wild; not listed in CISA KEV according to aggregator reports.
- The CVE record's CISA SSVC assessment lists exploitation as "poc" (proof of concept public) and automatable as "no".
- A public proof of concept is reported but not independently verified.
Our recommendation
- Update all Froxlor instances to version 2.3.14 or later.
- Check /var/lib/extrausers/group for unexpected entries, especially entries with GID 0 or unknown members.
- Review which customer accounts have panel access and remove unneeded accounts.
- Monitor the group file and system logs for changes to privileged groups.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v44g-c58r-37w2 github.com
- VulnCheck Advisory: Froxlor 0.10.0 before 2.3.14 Newline Injection www.vulncheck.com
- OSV: CVE-2026-109961 osv.dev
- VulDB entry 417689 vuldb.com
- Froxlor API guide: Ftps commands docs.froxlor.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:34.
Original description (NVD)
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.