Quick answers
- Is CVE-2026-100720 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-100720 being exploited in the wild.
- How severe is CVE-2026-100720?
- High severity, with a CVSS score of 8.7, published 26 September 2026.
- Which products and versions are affected?
- Froxlor 2.0.0 through 2.3.10.
- Is there a fix for CVE-2026-100720?
- A patch was published on 2026-09-26: Fixed in version 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-100720 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-100720?
- Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Stored XSS in Froxlor's certificate management where the Certificates API stores the issuer organization field from parsed SSL certificates without sanitization, and the table-listing renderer outputs this field through Twig's raw filter, bypassing HTML escaping. A customer with domain management access can upload self-signed certificates with attacker-controlled issuer values that execute as JavaScript in an administrator's session; the vulnerability requires an authenticated customer account and admin interaction (viewing the SSL certificates page), but enables privilege escalation from customer to admin and further to root via cron-executed configuration changes. A fix is available in version 2.3.12.
Affected products
- Froxlor Froxlor 2.0.0 through 2.3.10
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 2.3.12