CVE-2026-90767

Froxlor, an open-source server management and hosting control panel, fails to properly validate multi-line SSH public keys submitted through the SshKeys::add() endpoint in versions before 2.3.12. An authenticated hosting customer can submit a crafted 'public key' containing embedded newlines, injecting arbitrary lines into the server's authorized_keys files. By injecting malicious key entries carrying SSH option directives, an attacker gains persistent unauthorized SSH access that survives both key deletion in the panel and revocation of the customer's SSH privileges. Any Froxlor deployment before 2.3.12 where customers can add SSH keys is affected; exploitation requires a valid (low-privileged) customer account. No public PoC is known, there is no evidence of in-the-wild exploitation, and the flaw is not in the CISA KEV catalog, though it carries a high CVSS v4.0 score of 7.1 and is classified as CWE-93 (improper neutralization of CRLF/line sequences).

What to do: Upgrade Froxlor to version 2.3.12 or later, which properly validates multi-line SSH public keys. Until patched, consider disabling or restricting the customer SSH key management feature, and audit all authorized_keys files on affected servers for unexpected entries, extra lines, or option directives (e.g., command=, permitopen=) in keys added via the panel. Because injected entries survive panel-side key deletion and access revocation, treat any suspicious key as evidence of compromise: remove it, rotate credentials, and review SSH authentication logs for unauthorized logins.