CVE-2026-90937: froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
froxlorto a version that resolves this vulnerability.Fixed in 2.2.5 - Compensating control
If upgrading immediately is not possible, prevent untrusted/attacker-controlled values from reaching Froxlor's subdomain redirect URL feature (e.g., restrict who can set redirect URLs and ensure only trusted customers/inputs can be used) to mitigate config injection via newline characters.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor customer can exploit it by providing a subdomain redirect URL containing literal newline characters. No user interaction is required.
When does the malicious configuration take effect?
The supplied redirect URL is written into virtual-host configuration files during the cron rebuild process. The resulting injected nginx or Apache directives can affect HTTP responses across hosted domains.
Which deployments are affected?
Froxlor versions before 2.2.5 are affected where customers can configure subdomain redirect URLs and the configuration is rebuilt into nginx or Apache virtual-host files.
What is the impact of successful exploitation?
An attacker may inject arbitrary nginx or Apache configuration directives, causing web-server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.