The vulnerability in Froxlor allows an authenticated API user to request the DirProtections.listing command, which returns the directory protection configuration and, in affected releases, the htpasswd password hashes of users who control those directories. This data leakage exposes bcrypt hashes for protected directory accounts, enabling an attacker to perform offline dictionary or brute‑force attacks and potentially discover reused or weak credentials. The flaw is a classic credential‑disclosure weakness as classified under CWE-200.

The impact is on Froxlor installations running any version earlier than 2.3.12. The vendor listed is Froxlor and the affected product is the Froxlor web‑hosting control panel. No specific patch version is provided, but the fix is included in 2.3.12 and later releases.

The CVSS score of 7.1 indicates substantial severity, while the EPSS score is not available. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an authenticated API session, which is typically available to administrators or trusted collaborators, so the attack vector is restricted to those with valid credentials. Once accessed, the attacker can obtain password hashes and then attempt offline cracking attempts. The limited access requirement reduces the likelihood of broad exploitation compared to public‑facing remote code execution but still presents a significant risk in environments where API users have privileged roles.