EUVD Vulnerability Catalog
EUVD-2026-77455
Severity: CRITICAL
Base Score: 9.4
CVSS Version: 4.0
Vulnerability Description
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): Low
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): Low
▪
Subsequent Confidentiality Impact (SC): High
▪
Subsequent Integrity Impact (SI): High
▪
Subsequent Availability Impact (SA): Low
Affected Vendors & Systems
Vendor
froxlor
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
VulnCheck
EPSS Probability
0
Known Aliases
CVE-2026-90937
GHSA-r2fc-pw6p-x28w
Published On
2026-09-14
Last Updated
2026-09-14