A logic fault in input validation causes the "panel.adminmail" configuration field to skip email format checks, allowing an authenticated administrator to store arbitrary text. That text is later concatenated into a shell command executed by a root‑privileged cron job; the pipe character is explicitly allowed, enabling injection of arbitrary commands. The flaw exploits CWE‑78 (OS Command Injection) and, by bypassing input validation, also maps to CWE‑482. The resulting attack vector permits full control of the underlying system as root, compromising confidentiality, integrity, and availability.

The vulnerability affects all Froxlor installations prior to version 2.3.4. Administrators using older releases who have not applied the 2.3.4 update are susceptible. The product, Froxlor, is open‑source server‑administration software and the flaw exists in its core input‑validation subsystem.

With a CVSS score of 9.1 the threat is considered critical. Although the EPSS score is under 1%, the severity warrants immediate attention, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a legitimate administrator account and the ability to modify the "panel.adminmail" setting; once set, the root‑executed cron job will invoke the injected command. Because the injection is content‑based and does not require additional code‑execution constraints, exploitation under the stated conditions is straightforward.