PT-2026-22840 · Froxlor · Froxlor

Moonster8282 · Published 2026-03-03 · Updated 2026-03-23 · CVE-2026-26279

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.4

Description Froxlor is open source server administration software. A typo in the input validation code (using '==' instead of '=') disables email format checking for settings fields designated as email type. This allows an authenticated administrator to store arbitrary strings in the panel.adminmail setting. This value is then incorporated into a shell command executed as root by a cron job, with the pipe character '|' explicitly permitted. This results in root-level Remote Code Execution. The issue stems from a comparison operator being used instead of an assignment operator, effectively bypassing validation. The panel.adminmail setting is used in a shell command executed by a cron job, allowing for command injection.

Recommendations Versions prior to 2.3.4 should be updated to version 2.3.4.

Exploit

Fix

LPE

RCE

OS Command Injection

Weakness Enumeration

CWE-78

CWE-482

Related Identifiers

CVE-2026-26279

GHSA-33MP-8P67-XJ7C

Affected Products

Froxlor

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26279.json · Exploit
• https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c · Vendor Advisory
• https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343 · Patch
• https://osv.dev/vulnerability/CVE-2026-26279 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33mp-8p67-xj7c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26279 · Security Note
• https://github.com/froxlor/froxlor · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.4 · Note
• https://twitter.com/PentesterLab/status/2035911149921951846 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029075256803987521 · Twitter Post
• https://twitter.com/CVEnew/status/2028974434002805019 · Twitter Post
• https://twitter.com/CveFindCom/status/2028979109049549022 · Twitter Post
• https://twitter.com/pulsepatchio/status/2029571645673705480 · Twitter Post
• https://t.me/CVEtracker/46254 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029101809294516563 · Twitter Post