CVE-2026-90767

Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Published Sep 13, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

Analysis

Technical impact

Froxlor versions earlier than 2.3.12 accept multi‑line SSH public keys sent to the SshKeys::add() endpoint without proper validation, letting an attacker append arbitrary lines to any user’s authorized_keys file. By inserting SSH option directives, the injected key can remain active even after the original key is removed or the user’s normal SSH access is revoked, allowing a persistent foothold in the system.

Affected Systems

Every installation of Froxlor running any release before 2.3.12 is affected. The vulnerability is fixed only in version 2.3.12 and later.

Risk and Exploitability

The CVSS score of 7.1 classifies the flaw as high severity, while the EPSS score of < 1% indicates a low baseline probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack requires the ability to reach the SshKeys:: authenticated user with permission to add SSH keys. Once a malicious line is written to a user’s authorized_keys file, it persists through normal key‑management operations, enabling long‑term unauthorized access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

froxlor

Froxlor

unaffected

Version	Status	Constraints
`0`	affected	< 2.3.12

No data.

Vendor Product Versions

Froxlor

Version	Status	Scheme	Platform
`[0,2.3.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Frox or later to apply the fixed input‑validation in the SshKeys::add() endpoint.
Restrict access to the Froxlor API so that only trusted administrators can add SSH keys, ensuring that only privileged accounts can perform key‑management operations.
Audit the authorized_keys files on managed hosts regularly, scanning for anomalous lines or option directives that could indicate a prior injection attempt.

Generated by OpenCVE AI on September 15, 2026 at 17:00 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.435% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/froxlor/Froxlor
https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.php
https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.php
https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f
https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys

History

Sep 14, 2026 11:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 13, 2026 11:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Title		Froxlor before 2.3.12 SSH Key Injection via authorized_keys
First Time appeared		Froxlor Froxlor froxlor
Weaknesses		CWE-93
CPEs		cpe:2.3:a:froxlor:froxlor::::::::
Vendors & Products		Froxlor Froxlor froxlor
References		https://github.com/froxlor/Froxlor https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.php https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.php https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`