CVE-2026-90937 — froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration …
Published: 2026-09-14 · CVSS: 9.4 · CVSS 4.0
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7