CVE-2026-100719: Froxlor before 2.3.12 Credential Disclosure via DirProtections API
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor API user can exploit it. The vulnerable DirProtections.listing API command exposes htpasswd bcrypt password hashes for protected-directory users.
What is the practical impact of the disclosed data?
The exposed bcrypt hashes can be subjected to offline password-cracking attempts. If affected users reuse those passwords elsewhere, compromise may extend beyond the protected directories.
Which deployments are affected?
Froxlor versions before 2.3.12 are affected. The issue is relevant where authenticated users can access the DirProtections.listing API command and protected-directory accounts exist.