CVE-2026-26279 - Vulnerability Analysis

Overview

Froxlor < 2.3.4 contains a command injection caused by a typo in input validation disabling email format checking, letting authenticated admins achieve root-level remote code execution via shell command injection, exploit requires admin privileges.

Severity & Score

Impact

Authenticated admins can execute arbitrary code as root, leading to full system compromise.

Mitigation

Update to version 2.3.4 or later.

References

• https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c
• https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343
• https://github.com/froxlor/froxlor/releases/tag/2.3.4

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2026-26279 - Critical (9.1) Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticat... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26279/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner