EUVD-2026-77455

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

CVE-2026-90937

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs . An authenticated customer can supply URLs containing literal newlines that are written verbatim into vhost configuration files during the cron rebuild process, enabling injection of arbitrary nginx or A...