CVE-2026-109961CWE-74

CVE-2026-109961

High · published October 13, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-10-13T18:17Z
References (2)
https://github.com/froxlor/froxlor/security/advisories/GHSA-v44g-c58r-37w2 · [email protected]https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.14-newline-injection-via-ftps-add-additional-members · [email protected]
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 13 OCT 13:27Z
    Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
    cvelistv5
  • 13 OCT 13:27Z
    Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
    cvelistv5