Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90937

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

CVSS 4.0 9.4 CRITICALCVSS 3.1 9.9 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90937

Published

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90937

Published

froxlor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "froxlor",
                    "product": "froxlor",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "2.2.5"
                        },
                        {
                            "version": "2.2.5",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON