CVE-2026-90937
Last modified
CVE-2026-90937 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains..
Description
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| froxlor | froxlor | < 2.2.5 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-90937?
How severe is CVE-2026-90937?
How do I fix CVE-2026-90937?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90931LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize …5.4
- CVE-2026-90932LaraDashboard versions 0.9.2 through 1.2.2 contain a path tr…7.2
- CVE-2026-90933laradashboard through 1.2.2 contains a missing authorization…7.1
- CVE-2026-90934EspoCRM before 10.0.4 contains a field-level security bypass…4.3
- CVE-2026-90935Froxlor before 2.3.7 fails to validate the mysql_server para…4.3
- CVE-2026-90936Froxlor before 2.3.7 fails to properly scope sender alias lo…4.3
- CVE-2026-90938LangBot's plugin runtime (pip package langbot_plugin) throug…8.6
- CVE-2026-90939novel-plus through 5.3.3 contains an information disclosure …6.5
- CVE-2026-9094Casdoor versions 2.362.0 and earlier contain a vulnerability…9.8
- CVE-2026-90940novel-plus through 5.3.3 contains an insecure default cache-…5.3
- CVE-2026-90941novel-plus through 5.3.3 contains an authorization bypass vu…4.3
- CVE-2026-90942Casdoor through 4.4.0 fails to properly mask the instance-wi…9.6
Are you affected by CVE-2026-90937?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST