CVE-2026-100714 Details
Description
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec. Because safe_exec only blacklists shell metacharacters such as ; | & > < \ $ ~ ?, spaces and quotes survive and the value is word-split into additional acme.sh arguments. An administrator, or any actor able to write settings (for example through the settings-import API), can therefore inject acme.sh options such as --renew-hook, --pre-hook or --post-hook to obtain arbitrary command execution as root at the next Let's Encrypt cron run, or use --config-home/--cert-home for arbitrary file writes. Versions up to and including 2.3.10 are affected; the issue is fixed in 2.3.12.
A command injection vulnerability has been identified in Froxlor versions prior to 2.3.12. The issue arises because the 'system.letsencryptchallengepath' setting is not properly validated or escaped. Unlike other similar settings that were hardened, this field lacks a regular expression constraint and an OTP requirement. As a result, its value is directly concatenated into the acme.sh command line, which is executed by the root cron job. The method used to execute this command, 'FileDir::safe_exec', only filters out certain shell metacharacters, allowing spaces and quotes to pass through. This oversight enables an administrator or any user with the ability to modify settings, such as through the settings-import API, to inject acme.sh options. Such injections could include commands for executing scripts as root during the next Let's Encrypt cron run, or for writing arbitrary files using specific acme.sh flags. The vulnerability was introduced in version 2.3.10 and has been fixed in 2.3.12.
Users are advised to update Froxlor to version 2.3.12 or later, and to review all shell-related settings for similar vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-3w4g-cmpj-rj42 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/froxlor-before-2.3.12-command-injection-via-letsencryptchallengepath | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.10 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |