CVE-2026-90937

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.

Froxlor 2.3.7 through 2.3.8 in the API commands Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing returns full database rows without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8.

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files, including malicious SSH key entries with option directives.

Vulnerability in Froxlor before version 2.3.8. The lib/ajax.php entry point bypasses centralized request validation, and the editapikey action does not validate a CSRF token. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions.

Froxlor before version 2.3.8 has a vulnerability in the DomainZones.add API command that does not reject line delimiters, tab characters, semicolons, or unsupported DNS record types before serializing values into a BIND zone file. An authenticated customer with DNS-zone permissions can inject additional resource-record lines, bypassing field-level validation. BIND accepts the injected records, allowing modification of DNS data and potential DNS availability impact.

Froxlor before version 2.3.8 contains a SQL Injection vulnerability in the Admins.add and Admins.update endpoints, where an attacker-controlled ipaddress array is stored and later concatenated into a SQL IN clause without parameterization. An authenticated administrator with change_serversettings permission can exploit this to retrieve arbitrary database data, including admin credentials.