CVE-2026-100720 in Froxlor
Summary
by MITRE • 09/26/2026
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Froxlor versions 2.0.0 through 2.3.10 represents a critical stored cross-site scripting flaw that exploits insufficient input validation and unsafe output rendering mechanisms within the application's certificate management subsystem. The core technical defect lies in how the system handles SSL certificates uploaded by users with the lowest privileged role, specifically customers. When a customer uploads an SSL certificate for their domain via the Certificates API add or update methods, the backend processes the file using the PHP function openssl_x509_parse to extract metadata fields such as the issuer organization value. While this parsing step is necessary for displaying certificate details, the application fails to sanitize the extracted data before persisting it in the database. Consequently, an attacker can craft a malicious SSL certificate containing script payloads within the issuer organization field, which are then stored verbatim without any encoding or escaping applied at the point of ingestion.
The exploitation mechanism relies on Froxlor's frontend rendering engine, specifically its use of the Twig template framework. When administrative users, resellers, or other privileged roles navigate to the Domains section and view the SSL certificates list, the application retrieves the stored certificate metadata from the database and passes it directly to the Twig renderer. Crucially, the table-listing component utilizes Twig's raw filter on these scalar cells, which explicitly disables HTML auto-escaping for that specific output context. This configuration choice means that any special characters or script tags contained within the issuer organization field are rendered as executable code rather than being displayed as plain text. As a result, when an administrator loads this page in their browser, the malicious payload executes within the security context of the administrator's active session, effectively bypassing same-origin policies and allowing the attacker to interact with the application on behalf of the privileged user.
This vulnerability crosses significant privilege boundaries by enabling code execution from a low-privilege customer account up to high-privilege administrative sessions. The operational impact is severe because Froxlor serves as a control panel for managing web servers, DNS records, and PHP configurations. Once an attacker achieves cross-site scripting within the administrator's session, they can perform arbitrary actions such as creating new admin accounts, modifying server settings, or accessing sensitive configuration files. Furthermore, because many of these administrative functions trigger backend processes that may execute system commands via cron jobs running with root privileges, the vulnerability can be escalated from client-side script execution to remote code execution on the underlying operating system at the highest privilege level. This escalation path allows an attacker to gain full control over the managed server infrastructure, potentially leading to data exfiltration, lateral movement within a network, or complete service disruption.
From a classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing the payload in the database for later retrieval categorizes it under stored XSS variants where the persistence layer becomes part of the attack vector rather than just transient request parameters. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through browser-based exploitation and enables Privilege Escalation by leveraging trusted administrative sessions to perform unauthorized actions. The ability to execute scripts in an admin context also supports techniques related to Collection and Exfiltration if session cookies or sensitive data are accessed via JavaScript DOM manipulation.
Mitigation strategies must address both the immediate technical flaw and broader architectural security practices. The primary remediation is upgrading Froxlor to version 2.3.12 or later, where this specific parsing and rendering issue has been resolved by implementing proper input sanitization during certificate processing and ensuring that output encoding is enforced consistently across all template contexts. For environments unable to upgrade immediately, administrators should implement strict content security policies via HTTP headers to restrict script execution sources and disable inline scripts where possible, although this may impact legitimate application functionality. Additionally, applying principle of least privilege principles ensures that even if XSS occurs, the scope of damage is limited by restricting what administrative actions can be performed through automated means or cron jobs running as root. Regular security audits focusing on input validation in API endpoints and output encoding in templating engines are essential to prevent similar vulnerabilities from being introduced during future development cycles.