CVE-2026-109960

Executive Summary

Froxlor versions 2.0.0 through 2.3.13 contain a stored cross-site scripting (XSS) vulnerability that allows any authenticated customer-level user to inject persistent HTML and JavaScript via a malicious theme value set through customer_index.php. The injected payload executes in the browser context of an administrator who views the customer overview with the Theme column enabled, enabling token abuse (e.g., CSRF token theft) that can lead to full administrative account creation or modification of server settings. With a CVSS base score of 7.7 and no public PoC, exploit code, Nuclei template, or vendor patch currently confirmed, the risk is highest for multi-tenant Froxlor deployments where untrusted customers share an administrative panel.

Technical Analysis

The vulnerability is a CWE-79 stored (persistent) cross-site scripting flaw rooted in insufficient output encoding and input sanitization of a customer-controlled "theme" value.

Attack surface and trust boundary. Froxlor exposes separate customer and administrator interfaces. The customer_index.php endpoint (explicitly named in the NVD description) is reachable by authenticated customers and accepts a theme value that is stored server-side. Because the value is persisted and later rendered in an administrative view — specifically the customer overview page where the "Theme" column is enabled — the flaw crosses a privilege boundary: a low-privileged customer injects content that is executed in a high-privileged administrator's session.

Mechanism. Rather than encoding untrusted input at render time, the application stores the raw customer-supplied theme string and reflects it into the admin HTML output. If the theme value contains HTML tags and script (or event-handler attributes), the browser parsing the admin page interprets them as markup/script instead of inert text. This is the classic persistent XSS pattern: injection occurs once in the customer context, but the payload detonates later whenever an administrator loads the poisoned view. The CVSS scope change (S:C) and the vector's UI:R confirm that the attack requires the administrator to render the affected view, and the scope change reflects that the compromise escapes the vulnerable component into the administrator's broader privileges.

Why the theme field is dangerous. Theme/name fields are frequently treated as "presentational" and are less rigorously validated than fields like usernames or email addresses. Storing a theme value without context-aware HTML escaping means the database record itself becomes the delivery vehicle, so the payload survives page loads and can be reused across sessions until the record is modified.

The description does not disclose the exact encoding function, storage schema, or template engine involved; accordingly, no function or file names beyond customer_index.php and the Theme column should be assumed. The core defect is the mismatch between accepting customer-controlled markup and later emitting it unescaped to an administrator.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class and the NVD description and uses only the endpoints/fields named there.

1. Reconnaissance / target identification. An attacker gains a legitimate or compromised customer-level account on a Froxlor instance (customer accounts are typically provisioned for hosting tenants). The attacker confirms the instance runs a version in the 2.0.0–2.3.13 range.

2. Triggering the flaw. The authenticated customer submits a crafted value in the theme setting via customer_index.php. The payload is designed to execute JavaScript in the browser when the value is later rendered. Because this is stored XSS, the injection itself does not require administrator interaction; the value is simply persisted.

3. Payload / execution method (vulnerability-class level). The malicious theme value is stored and, when an administrator opens the customer overview with the Theme column enabled, the admin's browser parses the value as active content. Execution occurs in the administrator's authenticated session context (consistent with the S:C scope change).

4. Post-exploitation impact. Running in the admin session, the script can read the page/CSRF token and perform authenticated state-changing requests. Per the NVD description, the attacker can exploit the CSRF token to (a) create new administrator accounts — establishing persistence and privilege escalation — and/or (b) change server settings. This converts a single poisoned theme record into full administrative control of the Froxlor installation, affecting all hosted tenants.

Impact Assessment

CVSS 3.1 base score 7.7 (High), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.

• AV:N — triggerable over the network via the web interface.
• AC:H — exploitation requires specific conditions (administrator viewing the poisoned overview with the Theme column enabled).
• PR:L — requires only low-privileged (customer) authentication to inject.
• UI:R — the administrator must perform a normal UI action to detonate the payload.
• S:C — impact crosses the customer/administrator privilege boundary.
• C:H / I:H — confidentiality and integrity are both fully impacted (admin account creation, server setting changes); A:N — no direct availability impact.

Blast radius. Any Froxlor deployment with multiple customer accounts and an administrative overview is exposed. Successful exploitation yields administrator-level control: creation of rogue admin accounts, alteration of server/hosting configuration, and — in scope — broad access to all tenants and hosted services. Because exploitation is quiet (no service crash, no obvious error), the injected theme record serves as a persistent foothold. Business impact includes full loss of administrative trust, potential mass tenant compromise, and configuration tampering that can persist after the initial session ends.

Detection Guidance

Sigma Rule

title: Froxlor Stored XSS via Malicious Theme Value (CVE-2026-109960)
id: 3f5c9a21-7e4b-4d18-9a6f-cve2026109960
status: experimental
description: Detects customer-supplied theme values containing HTML/JavaScript markup submitted to customer_index.php in Froxlor 2.0.0-2.3.13
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109960
author: valtersit.com Threat Intelligence
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'customer_index.php'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '"><'
  condition: selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-method
  - sc-status
falsepositives:
  - Legitimate themes with angle brackets (rare)
level: high

YARA Rule

rule CVE_2026_109960_Froxlor_Stored_XSS_Theme
{
    meta:
        description = "Detects stored XSS payloads targeting Froxlor theme values (CVE-2026-109960)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109960"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep  = "customer_index.php" nocase
        $t1  = "<script" nocase
        $t2  = "javascript:" nocase
        $t3  = "onerror=" nocase
        $t4  = "onload=" nocase
        $t5  = "onmouseover=" nocase
        $theme = "theme" nocase

    condition:
        $ep and $theme and any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109960 Froxlor Stored XSS via theme parameter"; flow:established,to_server; http.uri; content:"customer_index.php"; nocase; http.uri; content:"theme"; nocase; pcre:"/(%3Cscript|%3Csvg|<script|javascript:|onerror%3D|onload%3D)/Ui"; classtype:web-application-attack; sid:2026109960; rev:1; reference:cve,2026-109960; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where url.path == "customer_index.php" and url.query : ("theme" and ("<script" or "javascript:" or "onerror=" or "onload=")) ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*customer_index.php*" uri_query="*theme*"
| where match(uri_query, "(?i)(%3Cscript|<script|javascript:|onerror=|onload=)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri_query status
| sort - count

Wazuh OSSEC Rule

<group name="web,froxlor,xss,">
  <rule id="1099600" level="10">
    <if_sid>31100</if_sid>
    <url>customer_index.php</url>
    <match>theme</match>
    <regex type="pcre2">(?i)(%3Cscript|&lt;script|&lt;svg|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-109960: Possible Froxlor stored XSS attempt via theme value in customer_index.php</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory references versions "before 2.3.14," but no vendor-confirmed fix, vendor advisory, or affected-version package data is available in tracked sources; validate against the vendor before relying on any specific fixed version.

1. Immediate mitigations

   • Disable the "Theme" column in the customer overview to interrupt the execution path where feasible, or constrain theme values to a server-side allowlist so arbitrary HTML/JS cannot be stored.
   • Treat theme fields as untrusted: apply context-aware output encoding when rendering customer data in any administrator view.
   • Restrict or temporarily suspend customer self-service theme editing until remediation is applied.
   • Audit existing customer records for stored payloads and remove suspicious theme values.
   • Enforce strong, unique admin credentials and monitor for newly created administrator accounts or unexpected server-setting changes.

2. Patch / upgrade steps

   • Confirm the fixed release with the vendor and upgrade Froxlor to the corrected version (advisory references "before 2.3.14"); do not assume the fixed version without vendor confirmation.
   • After upgrading, re-audit stored theme values and reset administrative sessions/tokens that may have been exposed.

3. Long-term hardening

   • Adopt context-aware output encoding (HTML entity encoding) for all user-controlled fields rendered in privileged views.
   • Implement server-side allowlist validation for theme/name fields.
   • Add Content-Security-Policy headers to reduce script execution impact.
   • Require re-authentication / re-confirmation for sensitive admin actions (admin account creation, server setting changes) and use anti-CSRF tokens that are not readable/abusable via injected script alone.
   • Alert on new administrator account creation events.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109960
• Froxlor project / vendor advisory: https://froxlor.org (verify fixed version for CVE-2026-109960)
• CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• MITRE ATT&CK T1059.007 (JavaScript): https://attack.mitre.org/techniques/T1059/007/

No known threat actor campaigns or exploit-in-the-wild evidence is available for CVE-2026-109960 at the time of writing; the CVE is not listed in CISA KEV, and no public PoC, exploit code, or Nuclei template exists in tracked sources.