Is CVE-2026-109961 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109961 being exploited in the wild.

How severe is CVE-2026-109961?

High severity, with a CVSS score of 8.5, published 13 October 2026.

How is CVE-2026-109961 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109961?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109961: Froxlor newline injection in Ftps.add API group database

CVE-2026-109961 · Severity: high · CVSS 8.5 · Published 2026-10-13

Froxlor is a web hosting control panel that manages FTP users and groups for Linux systems. An authenticated customer can inject newline characters into the group database through the FTP API, creating arbitrary groups with elevated privileges that survive system restarts. This allows a low-privilege customer account to escalate privileges on the hosting server by adding their account to privileged groups.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-109961 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109961 being exploited in the wild.
How severe is CVE-2026-109961?: High severity, with a CVSS score of 8.5, published 13 October 2026.
Which products and versions are affected?: Froxlor 0.10.0 before 2.3.14.
Is there a fix for CVE-2026-109961?: Yes: fixed in 2.3.14. Until then: Disable the FTP management feature in panel.customer_hide_options configuration if FTP access is not required, or disable system.nssextrausers to prevent use of the extrausers NSS source.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29"},{"kind":"advisory","at":"2026-10-13"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109961 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109961?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.14

Disable the FTP management feature in panel.customer_hide_options configuration if FTP access is not required, or disable system.nssextrausers to prevent use of the extrausers NSS source.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29"},{"kind":"advisory","at":"2026-10-13"}]

Technical details

The Ftps.add API endpoint accepts an unvalidated additional_members parameter that is written unsanitized into /var/lib/extrausers/group by the REBUILD_NSSUSERS cron job. By embedding a literal newline (0x0A) in additional_members, an attacker can inject arbitrary NSS group entries that are then parsed by libnss-extrausers and honored during authentication. This allows an authenticated customer with default panel permissions to craft entries like "evilgrp:x:0:username" to grant supplementary group membership and escalate privileges.

Affected products

Froxlor Froxlor 0.10.0 before 2.3.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.