Froxlor versions prior to 2.3.12 allow an attacker who can write configuration settings to inject arbitrary arguments into the acme.sh command that runs under root via the LetsEncrypt cron job. Because the letsencryptchallengepath value is concatenated without escaping, malicious input can include additional acme.sh options such as --renew-hook, --pre-hook, or --post-hook. When the cron job executes, these options trigger arbitrary command execution or file writes as the root user, compromising confidentiality, integrity, and availability of the system.

Affected vendor is Froxlor, a web hosting management panel. Versions from the release series 2.3.0 up through 2.3.10, inclusive, are vulnerable because they lack validation on the letsencryptchallengepath setting. The vulnerability was corrected in version 2.3.12, which no longer concatenates the setting without sanitization.

The CVSS score of 9.4 indicates critical severity. While the EPSS score is not available, the feature is exploitable in environments where the attacker can modify settings, such as through the settings-import API. Because the injected options are executed by a root cron job, successful exploitation results in arbitrary root command execution. The vulnerability is not listed in CISA's KEV catalog, but its high CVSS score warrants immediate attention.