Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-100714: Froxlor before 2.3.12 allows root command injection

CVE-2026-100714 · published 1 month ago

Summary

Froxlor versions prior to 2.3.12 let a user who can change settings add malicious text to the LetsEncrypt challenge path. That text is passed directly to a script run as the system's root user, so an attacker could run any command or write files as root when the certificate renewal runs. Update to version 2.3.12 or later to stop this behavior.

What to do

Update froxlor froxlor to version 2.3.12 or later.

Affected software

Vendor	Product	Affected versions
froxlor	froxlor	< 2.3.12

Original advisory text

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec. Because safe_exec only blacklists shell metacharacters such as ; | & > < \ $ ~ ?, spaces and quotes survive and the value is word-split into additional acme.sh arguments. An administrator, or any actor able to write settings (for example through the settings-import API), can therefore inject acme.sh options such as --renew-hook, --pre-hook or --post-hook to obtain arbitrary command execution as root at the next Let's Encrypt cron run, or use --config-home/--cert-home for arbitrary file writes. Versions up to and including 2.3.10 are affected; the issue is fixed in 2.3.12.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1007... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-100714 Vendor Advisory
https://github.com/froxlor/froxlor/security/advisories/GHSA-3w4g-cmpj-rj42 Vendor Advisory
https://www.vulncheck.com/advisories/froxlor-before-2.3.12-command-injection-via... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Timeline

Published26 Sep 2026

Updated4 Nov 2026

First seen26 Sep 2026

Sources

CVE-2026-100714 · NVD

CVE-2026-100714 · MITRE

CVE-2026-100714 · OSV

GHSA-3w4g-cmpj-rj42 · GHSA

Track software like this

Free during beta