---
id: CVE-2026-55593
title: Froxlor is open source server administration software
summary: >-
  Froxlor is open source server administration software. Prior to 2.3.8, the
  standalone lib/ajax.php entry point bypasses the centralized request
  validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php
  checks only for a v…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-352
vendor: froxlor
product: froxlor/froxlor
affected:
  - froxlor/froxlor <= 2.3.7
patched:
  - froxlor/froxlor 2.3.8
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:02:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55593'
references:
  - url: >-
      https://github.com/froxlor/froxlor/commit/5f540fe361e7e13e8c5a32805b793a25e9e26a0e
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/releases/tag/2.3.8'
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-xpr4-8vp6-c87j'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00232
epssPercentile: 0.1432
aliases:
  - GHSA-xpr4-8vp6-c87j
ecosystem: composer
ingestedAt: '2026-08-18T21:22:59.903Z'
---

## Overview

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55593)

Affected packages:

- `froxlor/froxlor <= 2.3.7`

Patched in:

- `froxlor/froxlor 2.3.8`

Source: https://github.com/advisories/GHSA-xpr4-8vp6-c87j