CVE-2026-90767: falha de alta gravidade em Froxlor
Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
froxlor · FroxlorCVEs relacionadas — Froxlor
No mesmo produto, das mais perigosas para as menos.
CVE-2024-34070CRITICALFroxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseEPSS 1.0%CVE-2026-26279CRITICALFroxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command InjectionEPSS 0.9%CVE-2025-48958MEDIUMFroxlor has an HTML Injection VulnerabilityEPSS 0.4%CVE-2025-29773MEDIUMFroxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account TakeoverEPSS 0.3%
Referências
https://github.com/froxlor/Froxlorhttps://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.phphttps://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.phphttps://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5fhttps://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys