CVE-2026-109961 froxlor CVE debrief

Who should care

System administrators and security teams responsible for Froxlor installations, especially those using versions prior to 2.3.14, should assess their exposure and consider upgrading to mitigate this high-severity vulnerability.

Why it matters

CVE-2026-109961 is a high-severity vulnerability in Froxlor that allows authenticated customers to inject arbitrary entries into the NSS group database, potentially leading to local privilege escalation. Defenders should prioritize verifying exposure, assessing impact, and considering upgrades to mitigate this risk.

• Potential local privilege escalation through injected group entries
• Risk of unauthorized access to sensitive system resources
• Need for verification of Froxlor version and exposure
• Possible impact on system integrity and confidentiality

Technical summary

The vulnerability exists in Froxlor versions 0.10.0 before 2.3.14. Authenticated customers can inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. This can lead to the creation of privileged group entries for local privilege escalation. The vulnerability is confirmed in Froxlor versions 0.10.0 before 2.3.14. The CVE Program and NVD provide official records of this vulnerability. Vendor and third-party advisories offer additional context. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using Froxlor versions prior to 2.3.14.

Recommended defensive actions

• Verify Froxlor version and check for exposure
• Assess the impact of potential local privilege escalation
• Consider upgrading to Froxlor version 2.3.14 or later
• Monitor systems for suspicious activity related to the Ftps.add API
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Froxlor versions 0.10.0 before 2.3.14. The CVE Program and NVD provide official records of this vulnerability. Vendor and third-party advisories offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.