CVE-2026-90937

froxlor, an open-source web-hosting control panel, fails to validate newline characters in customer-supplied subdomain redirect URLs in all versions before 2.2.5 (CWE-93 injection). An authenticated hosting customer can submit a redirect URL containing literal newlines, which are written verbatim into nginx or Apache vhost configuration files when froxlor's cron job rebuilds them. This allows the attacker to inject arbitrary web server directives, potentially corrupting configuration, causing denial of service across hosted sites, or hijacking HTTP responses for all domains on the affected server. Any froxlor deployment before 2.2.5 that grants customers the ability to configure subdomain redirects is affected. No public proof-of-concept or in-the-wild exploitation is known, though exploitation requires only low-privileged customer access (CVSS 4.0: 9.4 critical).

What to do: Upgrade to froxlor 2.2.5 or later, which validates newlines in redirect URLs. Until patched, audit existing subdomain redirect/path entries for embedded newline characters and inspect generated vhost files for unexpected directives. Consider restricting customer ability to set redirects and diff-review the cron-rebuilt web server configuration for anomalies.