The vulnerability allows authenticated customers to inject arbitrary configuration directives into nginx or Apache vhost files because the application does not validate newline characters in subdomain redirect URLs. This results in configuration corruption, known as injection of configuration files, likely enabling denial of service or response hijacking across hosted domains. The weakness is a classic configuration injection (CWE‑93).

All froxlor installations running versions earlier than 2.2.5 are affected. This includes every release that predates 2.2.5; no specific sub‑release list is provided. The vulnerability applies to both nginx and Apache setups managed by froxlor.

The CVSS score of 9.4 classifies this as Critical severity. The EPSS score is not available, so the likelihood of exploitation cannot be assessed with precision, but the lack of sanitization coupled with authenticated customer access makes exploitation feasible. The vulnerability is not listed in CISA KEV, yet the impact is substantial. Attackers would need authenticated customer credentials and would use the subdomain redirect URL feature to trigger the injection during a cron rebuild that writes the input directly to the vhost config files.