CVE-2026-26279
Critical · 9.1CVSS
9.1
EPSS
1.2%
Published
Mar 3, 2026
CISA due date
—
The record
Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | froxlor/froxlor | 0 | 2.3.4 |
Related vulnerabilities
- GHSA-33mp-8p67-xj7c Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command… Same vulnerability
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78