CVE-2026-26279

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-482

Affected software

No affected versions have been published.

Timeline

Published
Mar 3, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-26289.8The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up CVE-2026-262807.8systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the CVE-2026-262814.4InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnCVE-2026-262826.6NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap reaCVE-2026-262837.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `CVE-2026-262849.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImaCVE-2026-262868.5SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generationCVE-2026-262877.1External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting CVE-2026-262889.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate dCVE-2026-262898.2PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive infCVE-2026-26297.3A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function PromiseCVE-2026-262909.8The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the