CVE-2026-109961: Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additionalmembers parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILDNSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor customer can exploit it through the Ftps.add API by supplying crafted content in the additional_members parameter. No user interaction is required.
What access does an attacker need, and what is the impact?
The attacker needs valid customer-level authentication to the affected Froxlor instance. Successful exploitation lets them add arbitrary entries to the root-owned NSS group database, which can enable local privilege escalation.
Which component causes the injected data to become active?
The REBUILD_NSSUSERS cron process writes the unsanitized newline-containing value into /var/lib/extrausers/group. The resulting crafted group entries are the mechanism for privilege escalation.
What versions are affected?
Froxlor versions from 0.10.0 up to, but not including, 2.3.14 are affected.