Froxlor versions 2.0.0 through 2.3.10 allow a customer with the lowest authenticated role to upload an SSL certificate. During upload, the Certificate API parses the certificate with openssl_x509_parse() and stores the issuer's organization value without sanitization. When an administrator or reseller later view the SSL certificate list, the stored issuer string is emitted via Twig’s raw filter, disabling HTML escaping. The embedded JavaScript therefore executes in the privileged user's browser session, granting the attacker the privileges of that admin. Because a Froxlor administrator controls the web server, DNS, and PHP configuration applied by a cron job running as root, the attacker can elevate the compromise to arbitrary command execution on the managed server.

The affected product is the Froxlor web‑hosting administration panel. All releases from version 2.0.0 up to and including 2.3.10 are vulnerable. The issue was fixed in Froxlor 2.3.12.

The CVSS score of 9.3 reflects a high‑severity vulnerability. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires a legitimate authenticated customer account to upload a malicious certificate and an administrator (or reseller) to view the certificate list. The attack vector is user‑initiated within the application, but the resulting privilege escalation to administrator and potential for root execution make this vulnerability highly consequential.