Is CVE-2024-58383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58383 being exploited in the wild.

How severe is CVE-2024-58383?

High severity, with a CVSS score of 7.3, published 14 September 2026.

Which products and versions are affected?

Froxlor before 2.2.0 (including 2.2.0-rc3); froxlor/froxlor (Packagist) ECOSYSTEM:introduced=0,fixed=2.2.0.

Is there a fix for CVE-2024-58383?

Yes. froxlor/froxlor (Packagist): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58383 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2024-58383?

Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58383: Froxlor insecure file permissions in pure-ftpd MySQL configuration

CVE-2024-58383 · Severity: high · CVSS 7.3 · Published 2026-09-14

Froxlor, a server management control panel, stores database credentials in a configuration file with world-readable permissions. Unprivileged users on the system—including hosted website administrators who can upload scripts—can read this file to obtain database login credentials. With database access, attackers can modify administrator accounts and escalate privileges to root on affected systems running pure-ftpd.

Technologies: Froxlor, froxlor/froxlor (Packagist). Vendors: Froxlor, Packagist.

Quick answers

Is CVE-2024-58383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58383 being exploited in the wild.
How severe is CVE-2024-58383?: High severity, with a CVSS score of 7.3, published 14 September 2026.
Which products and versions are affected?: Froxlor before 2.2.0 (including 2.2.0-rc3); froxlor/froxlor (Packagist) ECOSYSTEM:introduced=0,fixed=2.2.0.
Is there a fix for CVE-2024-58383?: Yes. froxlor/froxlor (Packagist): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58383 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2024-58383?: Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

froxlor/froxlor (Packagist): upgrade to 2.2.0 or later
```
composer require froxlor/froxlor:^2.2.0
```

Technical details

Froxlor 2.1.9 through 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via XML configuration templates, exposing the SQL_UNPRIVILEGED_PASSWORD credential. Although the file is readable only by the owning user and group, parent directories (/etc/pure-ftpd/db/, /etc/pure-ftpd/, /etc/) are world-readable by default on Debian systems, allowing any system user to read the password file. This affects only instances configured to use pure-ftpd as the FTP daemon. An unprivileged attacker with local code execution—including virtual hosting users who can upload PHP or CGI scripts—can extract database credentials and subsequently modify Froxlor administrator password hashes and TOTP seeds to gain administrative access and execute arbitrary commands as root. The vulnerability is resolved in Froxlor 2.2.0 and later.

Affected products

Froxlor Froxlor before 2.2.0 (including 2.2.0-rc3)

Identifiers

CVE-2024-58383
GHSA-34qg-65m4-f23m

Timeline

2024-08-23: disclosed: GitHub Security Advisory GHSA-34qg-65m4-f23m published
2024-09-14: advisory: NVD advisory published as CVE-2024-58383

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.