In froxlor versions 2.3.10 and older, the URL validator accepts carriage return and line feed characters in the userinfo portion of a URL while rejecting them in the path, query and fragment fields. An authenticated low‑privilege user who has the ability to create subdomains can supply a redirect URL that contains a CR/LF payload in the userinfo component. The value passes validation and is encoded with IDNA, then written verbatim into the generated nginx or Apache vhost file. Because froxlor reloads the web‑server configuration as root, the injected CR/LF causes the directive to terminate early and allow the attacker to inject arbitrary configuration directives, potentially hijacking responses or reading local files. The vulnerability is fixed in froxlor 2.3.12.

The flaw affects the froxlor server administration panel, specifically all releases prior to 2.3.12. The vulnerability is exploitable only by users who can create subdomains, a privilege that may be granted to non‑admin customers but does not require full administrative rights.

The CVSS score of 8.5 reflects the high impact of the vulnerability. The EPSS score is not available, so there is no publicly available exploitation probability data. The vulnerability is not listed in the CISA KEV catalog. The exploit path is straightforward: a low‑privilege authenticated user submits a malicious URL, froxlor writes it to the server configuration, and the web server processes the injected directives, which can hijack responses or read local files.