CVE-2026-100714: Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safeexec. Because safeexec only blacklists shell metacharacters such as ; | & > < \ $ ~ ?, spaces and quotes survive and the value is word-split into additional acme.sh arguments. An administrator, or any actor able to write settings (for example through the settings-import API), can therefore inject acme.sh options such as --renew-hook, --pre-hook or --post-hook to obtain arbitrary command execution as root at the next Let's Encrypt cron run, or use --config-home/--cert-home for arbitrary file writes. Versions up to and including 2.3.10 are affected; the issue is fixed in 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An administrator or any actor able to write Froxlor settings can exploit it. The settings-import API is given as one example of a path that can provide this capability.
Does exploitation require a separate interactive shell or user interaction?
No user interaction is required. An attacker must be able to set system.letsencryptchallengepath, after which the malicious value is processed during the next Let's Encrypt cron run.
What level of access can an attacker obtain?
Injected acme.sh hook options such as --renew-hook, --pre-hook, or --post-hook can lead to arbitrary command execution as root. Options including --config-home or --cert-home can also be used for arbitrary file writes.
Which versions need remediation?
Versions up to and including 2.3.10 are affected. The issue is fixed in version 2.3.12.
What can be done if upgrading is not immediately possible?
Restrict access to Froxlor settings, including any settings-import API path, so untrusted actors cannot modify system.letsencryptchallengepath. Review that setting for values containing extra acme.sh arguments, since spaces and quotes can survive filtering and cause additional arguments to be passed.