CVE-2026-109961

Executive Summary

CVE-2026-109961 is a newline (CRLF) injection vulnerability in Froxlor, a widely deployed open-source web hosting control panel, affecting versions 0.10.0 through 2.3.13. An authenticated customer with FTP account privileges can supply newline characters through the additional_members parameter of the Ftps.add API; the unsanitized value is later written by the REBUILD_NSSUSERS cron job into /var/lib/extrausers/group, a root-owned NSS group database. This permits injection of arbitrary group entries, enabling local privilege escalation. With a CVSS base score of 8.5 (High), the vulnerability requires only low privileges and no user interaction, but provides high integrity impact with scope change because the attacker crosses from an application-level role into the operating system's identity resolution layer.

Technical Analysis

Froxlor is a server management panel that provisions web hosting services, including FTP accounts, for its customers. The Ftps.add API endpoint accepts an additional_members parameter, which is intended to represent the supplementary group memberships to be associated with an FTP account. The description states this parameter is unvalidated, meaning newline characters (\n) are not stripped or rejected before the value is persisted.

Froxlor maintains user and group information for its managed accounts in an "extrausers" NSS database — a Debian/Ubuntu mechanism in which /var/lib/extrausers/group and /var/lib/extrausers/passwd extend the system's identity resolution. The libnss-extrausers module causes these files to be consulted alongside the standard /etc/group database, meaning entries written into them become effective, resolvable groups on the host.

The REBUILD_NSSUSERS cron job is responsible for regenerating these files from Froxlor's internal state. Because it writes the additional_members value without sanitization, an injected newline terminates the intended group line and allows the attacker to begin a new, fully attacker-controlled line in /var/lib/extrausers/group. This is the core of the flaw: a structured, line-oriented system file is produced from untrusted input, and the input can supply the line delimiter itself.

The impact of this injection is that a local group entry — including privileged group records — can be forged with attacker-chosen group names, GIDs, and member lists. The newline injection therefore constitutes a persistent, server-side injection into the OS identity database rather than a transient web-layer issue. Because the file is root-owned, the attacker cannot write to it directly, but the privileged cron job performs the write on their behalf, effectively laundering the malicious content through a trusted, high-privileged component. This is also why the CVSS vector includes S:C (Scope Changed): exploitation of a vulnerability in the Froxlor application component impacts the operating system's security authority.

CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or "Injection") accurately captures the defect class: an application-level input is insufficiently neutralized before it enters a downstream consumer (the cron job and the NSS file format) that assigns special meaning to certain characters.

It should be noted that while the CNA title is empty in the supplied data, the NVD description itself is unusually detailed and provides the parameter name (additional_members), the API endpoint (Ftps.add), the cron job name (REBUILD_NSSUSERS), and the target file path (/var/lib/extrausers/group). These are reproduced verbatim; no additional internal function, symbol, or endpoint names are invented in this report.

Exploitation Scenarios

Because no public proof-of-concept or exploit code is available (POC_STATUS: None; Nuclei template: NO; exploit code: NO), the attack chain below is described at the vulnerability-class level, strictly anchored to the mechanics in the NVD description. No fabricated code or implementation details are supplied.

1. Reconnaissance / target identification. The attacker identifies an internet-facing Froxlor instance (for example via the Shodan dorks above) with a version in the affected range 0.10.0 through 2.3.13. The attacker must already possess a valid Froxlor customer account — the PR:L (low privileges) vector, meaning ordinary authenticated customer credentials are sufficient. The attacker confirms access to a role permitted to create or manage FTP accounts.

2. Triggering the injection. The attacker interacts with the Ftps.add API and supplies a crafted value in the additional_members parameter. Because the value is not validated, the attacker embeds newline (\n) characters so that the stored value spans multiple logical lines. At this stage the injection payload is likely persisted in Froxlor's data store and awaits the scheduled rebuild.

3. Payload delivery via the trusted cron path. On its schedule, the REBUILD_NSSUSERS cron job regenerates the extrausers database. It writes the attacker-supplied additional_members value directly into /var/lib/extrausers/group without sanitization. The injected newlines cause the content to be parsed as one or more additional group entries in a root-owned file, even though the attacker never had write access to that file.

4. Post-exploitation impact. The forged group entries become resolvable through NSS on the host. The description explicitly states this results in "creating privileged group entries for local privilege escalation." An attacker with local shell access (for example an FTP-authenticated local account or a separate low-privilege foothold) can leverage the newly created or augmented privileged group mappings to escalate privileges on the system. The attack is persistent by nature: the malicious entries can survive service restarts and remain in effect until the extrausers database is corrected.

Prerequisite caveats. The attack requires (a) an authenticated account on the vulnerable Froxlor installation, and (b) a scheduled or otherwise triggered execution of the REBUILD_NSSUSERS cron job for the injection to reach the target file. No public evidence of exploitation in the wild was provided with the CVE data; CISA KEV includes no entry for this CVE.

Impact Assessment

The CVSS v3.1 base score is 8.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L. Each subscore maps directly to the mechanics described above:

• AV:N (Attack Vector: Network) — the Ftps.add API is reached over the network; no physical or adjacent access is required.
• AC:L (Attack Complexity: Low) — the flaw requires no race condition or specialized conditions; only a valid account and a crafted parameter value.
• PR:L (Privileges Required: Low) — the attacker must be an authenticated customer, consistent with "authenticated customers" in the description.
• UI:N (User Interaction: None) — no victim action is required; the cron job processes the injected value automatically.
• S:C (Scope Changed) — the critical attribute of this CVE. The vulnerable component is the Froxlor application, but the impacted component is the host operating system's identity/authentication authority. A flaw in the panel therefore compromises the underlying system's privilege model.
• C:N (Confidentiality: None) — the flaw as described does not directly expose data; the vector assigns no confidentiality impact.
• I:H (Integrity: High) — arbitrary entries are written into a root-owned NSS group database, which is a severe integrity violation of a system-critical file.
• A:L (Availability: Low) — some availability impact is anticipated, consistent with alteration of system identity configuration.

Business impact. A Froxlor server is typically a multi-tenant hosting control plane managing many customers and web properties. Compromise of the host's group database via local privilege escalation undermines isolation between tenants and can lead to full server takeover, tampering with hosted content, credential theft, or use of the host as a pivot into adjacent infrastructure. Because the malicious group entries are persistent, the compromise may not be obvious after routine restarts, and remediation requires auditing and correcting the extrausers database rather than simply restarting services.

Blast radius. Any Froxlor installation in the affected version range with an active REBUILD_NSSUSERS cron job and the extrausers NSS mechanism in use is exposed. Because the flaw allows low-privileged customers to reach root-mediated state, the blast radius extends from a single customer account to the entire host and, potentially, all tenants on it. The EPSS score has not yet been assigned by FIRST.org, and no CISA KEV listing exists, so predictive exploitation pressure cannot be quantified at this time.

Detection Guidance

Sigma Rule

title: Froxlor Ftps.add additional_members Newline Injection Attempt
id: 3f6a9d1c-1099-61c0-b7a1-4f2c8e7d5a10
status: experimental
description: Detects attempts to inject newline characters into the additional_members parameter of the Froxlor Ftps.add API, consistent with CVE-2026-109961.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109961
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: 'Ftps.add'
  selection_payload:
    - cs-uri-query|contains:
        - '%0a'
        - '%0d'
        - 'additional_members'
    - cs-body|contains:
        - 'additional_members'
  condition: selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-body
falsepositives:
  - Legitimate FTP group configuration containing encoded characters
level: high

YARA Rule

rule CVE_2026_109961_Froxlor_Newline_Injection
{
    meta:
        description = "Detects Froxlor additional_members newline injection artifacts in request logs or NSS database content"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109961"
        date = "2026-01-01"
        severity = "high"

    strings:
        $api = "Ftps.add" ascii wide nocase
        $param = "additional_members" ascii wide nocase
        $nss = "/var/lib/extrausers/group" ascii wide
        $rebuild = "REBUILD_NSSUSERS" ascii wide nocase

    condition:
        ($api or $param) and ($nss or $rebuild)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109961 Froxlor Ftps.add additional_members Newline Injection"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"Ftps.add"; http.request_body; content:"additional_members"; pcre:"/additional_members[^&]*(%0a|%0d|\\x0a|\\x0d)/i"; classtype:attempted-admin; reference:cve,2026-109961; sid:2026109961; rev:1;)

Elastic Detection

api where process.name == "cron" or process.name == "cron.daily"

More specific EQL targeting NSS database writes combined with web activity:

sequence by host.id with maxspan=10m
  [network where http.request.method == "POST" and
     http.request.body.text contains "additional_members"]
  [file where file.path == "/var/lib/extrausers/group" and event.action in ("write", "creation")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval raw = method." ".uri." ".uri_query." ".http_user_agent
| where (uri LIKE "%Ftps.add%" OR uri_query LIKE "%Ftps.add%")
| where (uri_query LIKE "%additional_members%" OR uri_query LIKE "%0a%" OR uri_query LIKE "%0d%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, uri_query, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="froxlor,web,cve-2026-109961,">
  <rule id="100961" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">Ftps\.add</field>
    <regex type="pcre2">additional_members.*(%0a|%0d|\\x0a|\\x0d)</regex>
    <description>CVE-2026-109961: Possible Froxlor Ftps.add newline injection via additional_members parameter.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="100962" level="10">
    <if_sid>550</if_sid>
    <field name="file">/var/lib/extrausers/group</field>
    <description>CVE-2026-109961: Unexpected change to extrausers NSS group database (possible injected group entry).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. There is no vendor fix, workaround, or affected-version package data supplied by the tracked sources, although the CNA description states that versions before 2.3.14 are affected and therefore implies 2.3.14 as the remediating release. The following guidance is defensive and does not rely on a specific vendor patch.

1. Immediate mitigations (compensating controls):

   • Restrict access to the Ftps.add API and to the customer-facing FTP management functionality to trusted accounts; where possible, disable self-service FTP account creation for untrusted tenants.
   • Review and minimize the authorization level granted to hosting customers so that few accounts can invoke Ftps.add.
   • Audit /var/lib/extrausers/group (and the related extrausers database) for unexpected or malformed group entries — particularly entries containing control characters or unusual group names/GIDs.
   • Monitor the REBUILD_NSSUSERS cron job for unexpected output or abnormal file changes using the detection guidance above.
   • Where operationally acceptable, consider temporarily suspending or tightly scoping the REBUILD_NSSUSERS cron job so injected values are not propagated, at the cost of stale NSS data.
   • Apply an input-validation compensating control at the perimeter (WAF/reverse proxy) to reject requests containing unencoded or encoded newline characters (%0a, %0d, \n, \r) in the additional_members parameter to Ftps.add.

2. Patch / upgrade steps:

   • Upgrade Froxlor to version 2.3.14 or later, which the CNA description identifies as the boundary after which the affected range ends. Verify the release notes and changelog of that version for the corresponding fix reference before deployment.
   • Because patch confidence is 0/4 and no upstream advisory link was supplied in the data, security teams should independently confirm the fix with the Froxlor project before treating an upgrade as complete remediation.
   • After upgrading, rebuild and validate the extrausers NSS database and confirm that no injected entries persist from prior exposure.

3. Long-term hardening:

   • Enforce strict server-side input validation and output encoding for all parameters that are later written to structured, line-oriented system files. Newline, carriage return, and delimiter characters should be rejected at the API boundary.
   • Treat the NSS extrausers database as a security-critical file and alert on any modification outside known-good change windows.
   • Run the web-facing Froxlor application and the privileged NSS-rewriting cron job under least privilege, and consider filesystem integrity monitoring for /var/lib/extrausers/.
   • Adopt a vulnerability management cadence that tracks Froxlor releases, given the absence of CISA KEV visibility for this issue.
   • Apply defense-in-depth tenant isolation so that a single low-privileged customer account cannot reach host-level identity configuration.

References

• NVD — CVE-2026-109961: https://nvd.nist.gov/vuln/detail/CVE-2026-109961
• Froxlor project (upstream software project): https://froxlor.org
• CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ("Injection"): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• FIRST EPSS (score not yet published for this CVE): https://api.first.org/data/v1/epss

Threat actor / exploitation status: No public proof-of-concept, exploit code, or Nuclei template was identified in the supplied data. There is no CISA KEV listing for CVE-2026-109961, and no named threat actor campaign or exploit-in-the-wild evidence was provided. EPSS has not yet been scored by FIRST.org. As a result, no attribution or active-campaign assessment can be made at this time.