CVE-2026-100717 - froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
Brief
CVE ID : CVE-2026-100717
Published : Sept. 26, 2026, 2:16 p. m.
- 6 hours, 44 minutes ago
Description : froxlor is a server administration panel. In versions 2.
- 10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2.
An authenticated low-privilege customer with subdomain-create rights (no admin or change_serversettings privilege required) can supply a subdomain redirect URL that carries a CR/LF payload in the userinfo portion (e. g. http://user%0areturn200 "pwned";%0a@evil. com/).