CVE-2026-100720: Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with opensslx509parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's raw filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor customer, the lowest-privileged role, can exploit it by uploading an SSL certificate for one of their own domains. The attacker does not need administrator or reseller permissions.
Who is exposed to the malicious script?
Administrators and resellers are exposed when they open Domains > SSL certificates and view the affected certificate entry. The stored issuer organization value executes in the privileged viewer's session.
What is the likely impact after successful exploitation?
The issue can enable takeover of an administrator account. Because Froxlor administrators control webserver, DNS, and PHP configuration that is applied by a root-run cron job, this can be further escalated to root command execution on the managed server.
Which installations are known to be vulnerable and what version fixes it?
Froxlor versions 2.0.0 through 2.3.10 are identified as vulnerable. The issue is fixed in Froxlor 2.3.12.