CVE-2026-100714

Executive Summary

CVE-2026-100714 is an argument injection vulnerability (CWE-88) in Froxlor versions up to and including 2.3.10, caused by missing sanitization of the system.letsencryptchallengepath setting. An administrator or any actor able to write Froxlor settings can inject arbitrary acme.sh command-line options that are executed as root during the Let's Encrypt cron run, resulting in full root command execution or arbitrary file writes. With a CVSS base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and no public PoC or upstream patch evidence currently tracked, the vulnerability represents a critical privilege-escalation and persistence risk for every unpatched Froxlor deployment.

Technical Analysis

The vulnerability resides in the handling of the system.letsencryptchallengepath configuration setting. Per the NVD description, this setting is not restricted or escaped, in contrast to sibling settings that were previously hardened under advisory GHSA-33mp. The field lacks either a string_regexp or a required_otp guard, meaning no input validation or escaping layer is applied before the value is used.

The unvalidated value is concatenated unescaped into the acme.sh command line constructed in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php. This command line is then executed by the root cron via FileDir::safe_exec. The described safe_exec implementation uses a blacklist approach that removes shell metacharacters such as ;, |, &, >, <, \, $, and ~. Because this blacklist is incomplete, spaces and quotation marks survive sanitization. Surviving spaces are significant: the malicious setting value is word-split into additional arguments passed to acme.sh. This turns an intended single configuration value into attacker-controlled command-line options.

The practical consequence of CWE-88 (Argument Injection) is that any acme.sh option can be supplied as an extra argument. The NVD description explicitly identifies --renew-hook, --pre-hook, and --post-hook as injectable options that yield arbitrary command execution as root when the Let's Encrypt cron next runs. It also identifies --config-home and --cert-home as options that allow arbitrary file writes. Because the vulnerable component is invoked from a root cron job, the privilege boundary crossed is administrator-to-root and, when settings write access is obtained through the settings-import API, potentially remote-to-root.

Attack surface: the setting is externally influenceable in two ways described by the NVD — direct modification by a privileged administrator, and indirect modification by any actor able to write settings, for example via the settings-import API. This second path expands the initial access requirement beyond interactive administrative use of the panel.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a Froxlor deployment, for example through its web interface or known exposed administrative endpoints. The target must be running a version up to and including 2.3.10. Reconnaissance focuses on whether the attacker already holds administrative access or can write settings via the settings-import API.

2. Triggering the flaw class: The attacker modifies the system.letsencryptchallengepath setting and supplies a value containing spaces followed by an acme.sh option. Because safe_exec only blacklists shell metacharacters such as ;, |, &, >, <, \, $, and ~, spaces and quotes survive, and the value is word-split into additional acme.sh arguments. No valid string_regexp or required_otp constraint blocks the payload.

3. Payload/execution method: At the vulnerability-class level, the injected argument causes acme.sh to treat attacker-supplied options as legitimate command-line flags. The NVD description names --renew-hook, --pre-hook, and --post-hook as options that lead to arbitrary command execution as root, and --config-home/--cert-home as options that lead to arbitrary file writes. The injected command executes when the root cron job next runs the Let's Encrypt certificate process.

4. Post-exploitation impact: Successful exploitation yields arbitrary command execution with root privileges, enabling full compromise of the Froxlor host, persistence via cron or injected hooks, credential and configuration theft, and arbitrary file writes to attacker-chosen locations. Because the code path is a scheduled root process, execution is effectively delayed and unattended, complicating immediate observation.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the NVD description.

Impact Assessment

The CVSS 3.1 base score is 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Network attack vector (AV:N) and low attack complexity (AC:L) mean the flaw is reachable without physical or local positioning and without specialized conditions. High privileges are required (PR:H) and no user interaction is needed (UI:N). Scope is changed (S:C), reflecting that impact crosses from the Froxlor application into the underlying root operating system context. Confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H).

Business impact is severe: root-level code execution can lead to complete host takeover, exfiltration of certificate private keys and configuration secrets, tampering with hosted web content, and establishment of persistent backdoors. Blast radius includes the Froxlor host and any domains, certificates, and secrets it manages. Organizations running Froxlor on internet-exposed infrastructure should treat this as a critical configuration-management risk. No EPSS score has been published and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Froxlor letsencryptchallengepath Argument Injection via Settings Update
id: 7b2f6a1e-4c9d-4a2b-9e6f-1a2b3c4d5e6f
status: experimental
description: Detects attempts to set the Froxlor system.letsencryptchallengepath setting with shell-style argument injection payloads.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100714
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: froxlor
detection:
  selection_setting:
    setting|contains: 'letsencryptchallengepath'
  selection_payload:
    setting_value|contains:
      - '--renew-hook'
      - '--pre-hook'
      - '--post-hook'
      - '--config-home'
      - '--cert-home'
  condition: selection_setting and selection_payload
falsepositives:
  - Legitimate administrator configuration of acme.sh hook paths
level: high
tags:
  - attack.t1190
  - cve.2026.100714

YARA Rule

rule CVE_2026_100714_Froxlor_LetsEncrypt_ArgInjection
{
    meta:
        description = "Detects Froxlor letsencryptchallengepath argument injection payloads in configuration or logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100714"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "letsencryptchallengepath" ascii nocase
        $p1 = "--renew-hook" ascii
        $p2 = "--pre-hook" ascii
        $p3 = "--post-hook" ascii
        $p4 = "--config-home" ascii
        $p5 = "--cert-home" ascii

    condition:
        $s1 and any of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100714 Froxlor letsencryptchallengepath Argument Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"settings"; nocase; http.request_body; content:"letsencryptchallengepath"; nocase; http.request_body; content:"--renew-hook"; nocase; sid:2026100714; rev:1; reference:cve,2026-100714; classtype:attempted-admin; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert http any any -> any any (msg:"CVE-2026-100714 Froxlor letsencryptchallengepath Hook Option Injection"; flow:established,to_server; http.request_body; content:"letsencryptchallengepath"; nocase; pcre:"/(--renew-hook|--pre-hook|--post-hook|--config-home|--cert-home)/i"; sid:2026100715; rev:1; reference:cve,2026-100714; classtype:attempted-admin;)

Elastic Detection

process where event.action == "start" and
  process.name in ("acme.sh", "sh", "bash") and
  process.command_line : ("--renew-hook*", "--pre-hook*", "--post-hook*", "--config-home*", "--cert-home*") and
  process.parent.name : ("cron", "crond")

Splunk SPL Query

index=froxlor OR index=web OR index=syslog
| search (setting="*letsencryptchallengepath*" OR command_line="*letsencryptchallengepath*")
| search (command_line="*--renew-hook*" OR command_line="*--pre-hook*" OR command_line="*--post-hook*" OR command_line="*--config-home*" OR command_line="*--cert-home*")
| eval risk="CVE-2026-100714 argument injection"
| table _time host user setting command_line risk
| sort - _time

Wazuh OSSEC Rule

<group name="froxlor,cve-2026-100714,">
  <rule id="100714" level="12">
    <decoded_as>json</decoded_as>
    <field name="setting">letsencryptchallengepath</field>
    <match>--renew-hook|--pre-hook|--post-hook|--config-home|--cert-home</match>
    <description>CVE-2026-100714: Possible Froxlor letsencryptchallengepath argument injection attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,attempted_admin,</group>
  </rule>

  <rule id="100715" level="14">
    <decoded_as>json</decoded_as>
    <field name="command_line">acme.sh</field>
    <match>--renew-hook|--pre-hook|--post-hook</match>
    <description>CVE-2026-100714: acme.sh invoked with injected hook option under root cron.</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>attack,execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict write access to Froxlor settings so that only fully trusted administrators can modify configuration, and if the settings-import API is enabled, disable it or tightly restrict network access to it until the fix is confirmed. Audit the current value of system.letsencryptchallengepath for spaces, quotes, or any acme.sh option tokens and reset it to a plain path. Where possible, constrain the Froxlor root cron account so that any single compromise cannot exceed the minimum necessary privileges.

2. Patch/upgrade steps: The vulnerability is fixed in Froxlor 2.3.12. Upgrade all affected hosts running 2.3.10 or earlier to 2.3.12. Because no patch source or commit reference is currently tracked under this CVE, verify the fix against the official Froxlor release before considering the issue resolved.

3. Long-term hardening: Replace blacklist-based command sanitization such as the safe_exec approach with argument-safe process invocation (for example, passing arguments as an array rather than a shell string), enforce string_regexp or required_otp guards on all configuration fields, and adopt an allowlist model for acme.sh options. Add configuration-integrity monitoring to detect unauthorized setting changes.

References

• NVD — CVE-2026-100714: https://nvd.nist.gov/vuln/detail/CVE-2026-100714
• Froxlor project (release information for 2.3.12): https://froxlor.org/
• GHSA-33mp (referenced in the NVD description as the prior hardening advisory for sibling settings)
• CWE-88 — Argument Injection: https://cwe.mitre.org/data/definitions/88.html
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-100714 is NOT currently listed)