CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additionalmembers parameter of the Ftps.add API. Attackers can embed newline characters that the...