CVE-2026-109960 froxlor CVE debrief

Who should care

Defenders responsible for Froxlor installations, particularly those with customer theme customization enabled, should assess exposure and apply remediation to prevent potential XSS attacks.

Why it matters

CVE-2026-109960 is a stored XSS vulnerability in Froxlor 2.0.0 before 2.3.14 that allows authenticated customers to inject malicious code, potentially leading to administrator account creation or server setting modifications.

• Potential for attackers to create administrator accounts
• Possible modification of server settings via CSRF token abuse
• Required verification of Froxlor version and exposure
• Need for enhanced monitoring of administrator actions

Technical summary

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. This vulnerability can be exploited when an administrator views the customer overview with the Theme column enabled, potentially leading to administrator account creation or server setting modifications. Defenders should prioritize verifying exposure and applying the vendor's remediation to prevent potential XSS attacks.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor's remediation to prevent potential XSS attacks.

Recommended defensive actions

• Verify Froxlor version and apply 2.3.14 or later if vulnerable
• Restrict customer theme value input to prevent malicious injection
• Monitor administrator actions for potential CSRF abuse
• Review and update CSRF token implementation
• Perform a thorough review of existing customer theme values for potential malicious code
• Implement additional logging and monitoring for administrator actions
• Conduct a security audit of Froxlor installations to identify potential vulnerabilities

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or victim impact. Defenders should verify Froxlor version and exposure, review customer theme customization, and monitor for potential malicious activity. Evidence is limited, and further verification is required to assess the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.