---
id: CVE-2026-54348
title: Froxlor is open source server administration software
summary: >-
  Froxlor is open source server administration software. Prior to 2.3.8, the
  Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php
  accept an attacker-controlled ipaddress array and store it as JSON in
  panel_admins.i…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: froxlor
product: froxlor/froxlor
affected:
  - froxlor/froxlor < 2.3.8
patched:
  - froxlor/froxlor 2.3.8
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:02:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54348'
references:
  - url: >-
      https://github.com/froxlor/froxlor/commit/a1eaca5a1601c8a30e00814a4fc73ad0c185f89e
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/releases/tag/2.3.8'
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4'
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-w27m-rmmf-g5w4'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00655
epssPercentile: 0.49219
aliases:
  - GHSA-w27m-rmmf-g5w4
ecosystem: composer
ingestedAt: '2026-08-18T21:22:59.974Z'
---

## Overview

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel_admins.ip without enforcing numeric element types. When the poisoned account later calls IpsAndPorts.listing, lib/Froxlor/Api/Commands/IpsAndPorts.php decodes the array and concatenates its elements into a SQL IN clause without casting or parameterization; the same unsafe pattern is present in lib/Froxlor/Api/Commands/Domains.php. An authenticated administrator with change_serversettings permission can store a UNION-based payload and trigger it through the poisoned account to retrieve arbitrary database data, including administrator login names and bcrypt password hashes, with potential privilege escalation and broader database impact. This issue is fixed in version 2.3.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54348)

Affected packages:

- `froxlor/froxlor < 2.3.8`

Patched in:

- `froxlor/froxlor 2.3.8`

Source: https://github.com/advisories/GHSA-w27m-rmmf-g5w4