CVE-2026-90767CWE-93

CVE-2026-90767

Medium · published September 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00435 · 36.8th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-09-13T15:17Z
References (6)
https://github.com/froxlor/Froxlor · [email protected]https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.php · [email protected]https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.php · [email protected]https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f · [email protected]https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys · [email protected]https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 10:45Z
    Froxlor before 2.3.12 SSH Key Injection via authorized_keys
    cvelistv5