CVE-2026-90767— Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Quick assessment
Affected
froxlor Froxlor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Froxlor 2.3.12 之前的版本在 SshKeys::add() 接口中未能正确验证多行 SSH 公钥，允许用户向 authorized_keys 文件中注入任意行。攻击者可以注入带有选项指令的恶意 SSH 密钥条目，从而获得持久的未授权访问权限，且该访问权限在密钥删除或撤销 SSH 访问权限后依然存在。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90767
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Source: CVE Program / CVE List V5
Vulnerability Description
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90767
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90767
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90767 (2)
-
🔗 SSH authorized_keys injection via multi-line ssh_pubkey (customer-controlled) · Advisory · froxlor/froxlor · GitHub Read full article third-party-advisory vendor-advisory
-
Proof of Concept for CVE-2026-90767 (1)
Vendor Pages for CVE-2026-90767 (1)
Other References for CVE-2026-90767 (1)
IV. Related Vulnerabilities
Same product: Froxlor
-
CVE-2026-90936
Froxlor before 2.3.7 Information Disclosure via customer_ema -
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection vi -
CVE-2026-90935
Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API -
CVE-2024-58383
Froxlor before 2.2.0 Insecure File Permissions mysql.conf -
CVE-2026-55593
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missi
Same vendor: froxlor
-
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection vi -
CVE-2026-90936
Froxlor before 2.3.7 Information Disclosure via customer_ema -
CVE-2026-90935
Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API -
CVE-2024-58383
Froxlor before 2.2.0 Insecure File Permissions mysql.conf -
CVE-2026-55593
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missi
Same weakness: CWE-93
-
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection vi -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-75925
IXON VPN Client CRLF Injection -
CVE-2026-84962
Authenticated KMS request forgery via CRLF injection in GCP -
CVE-2026-84379
HTTPX2: Multipart part header injection via unvalidated file
V. Comments for CVE-2026-90767
No comments yet