SCA: security update for froxlor/froxlor (GHSA-w27m-rmmf-g5w4)

high Tenable Self-Hosted Container Security Plugin ID 446081

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update
endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store
it as JSON in panel_admins.ip without enforcing numeric element types. When the poisoned account later
calls IpsAndPorts.listing, lib/Froxlor/Api/Commands/IpsAndPorts.php decodes the array and concatenates its
elements into a SQL IN clause without casting or parameterization; the same unsafe pattern is present in
lib/Froxlor/Api/Commands/Domains.php. An authenticated administrator with change_serversettings permission
can store a UNION-based payload and trigger it through the poisoned account to retrieve arbitrary database
data, including administrator login names and bcrypt password hashes, with potential privilege escalation
and broader database impact. This issue is fixed in version 2.3.8. (CVE-2026-54348)

Solution

Update the froxlor/froxlor library and its related packages to version 2.3.8 or later.

Plugin Details

Severity: High

ID: 446081

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/19/2026

Updated: 8/19/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-54348

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-54348

cwe: CWE-89

Detections

Analytics