PT-2026-22840 · Froxlor · Froxlor

Moonster8282 · Published 2026-03-03 · Updated 2026-03-23 · CVE-2026-26279

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.4

Description Froxlor is open source server administration software. A flaw in the input validation code, specifically a typo where '==' was used instead of '=', disables email format checking for settings fields declared as email type. This allows an authenticated administrator to store arbitrary strings in the panel.adminmail setting. This value is then used in a shell command executed as root by a cron job, where the pipe character '|' is explicitly whitelisted, leading to remote code execution.

Recommendations Upgrade to version 2.3.4 to address this issue.

Fix

RCE

LPE

OS Command Injection

Weakness Enumeration

CWE-78

CWE-482

Related Identifiers

CVE-2026-26279

GHSA-33MP-8P67-XJ7C

Affected Products

Froxlor

References · 13

• https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c · Vendor Advisory
• https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343 · Patch
• https://osv.dev/vulnerability/GHSA-33mp-8p67-xj7c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26279 · Security Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.4 · Note
• https://github.com/froxlor/froxlor · Note
• https://twitter.com/PentesterLab/status/2035911149921951846 · Twitter Post
• https://twitter.com/pulsepatchio/status/2029571645673705480 · Twitter Post
• https://twitter.com/CveFindCom/status/2028979109049549022 · Twitter Post
• https://twitter.com/CVEnew/status/2028974434002805019 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029101809294516563 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029075256803987521 · Twitter Post
• https://t.me/CVEtracker/46254 · Telegram Post