Froxlor 0.10.0 through 2.3.13 contains a newline injection flaw in the Ftps.add API's "additional_members" parameter. The injection exploits the fact that unvalidated newline characters are written directly to the NSS group database by the REBUILD_NSSUSERS cron job. An authenticated customer can thus place arbitrary privileged group entries into /var/lib/extrausers/group, gaining local administrative access. The vulnerability is a form of input validation failure, characterized as CWE‑74.

Systems running Froxlor versions 0.10.0 up to but not including 2.3.14 are affected. The set of impacted installations is any host whose Froxlor instance exposes the Ftps.add API to authenticated users.

With a CVSS score of 8.4, the flaw is classified as high severity. No EPSS score is published, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires legitimate authentication to Froxlor and the ability to call the Ftps.add endpoint with the vulnerable parameter; once executed, the newly created group entries enable local privilege escalation on the system. The vulnerability is likely to be exploited if attackers can gain authenticated access and abuse the API.