Skip to content
Heist/ feed
Back to feed
High

Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Type: advisorySources: OSV

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-90767
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 01:23 UTC · Revision 1

Source evidence

Froxlor before 2.3.12 SSH Key Injection via authorized_keys

core-osv · Original source

Published 13 Sept 2026, 10:45 UTC

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

osv:CVE-2026-90767
Complete source record
{
  "id": "94e344f006000c18e0e61d2e07b7df6176f39bdbed4734d4723831ba9c9a2dcd",
  "url": "https://osv.dev/vulnerability/CVE-2026-90767",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Froxlor before 2.3.12 SSH Key Injection via authorized_keys",
    "summary": "Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.",
    "evidence": "osv:CVE-2026-90767",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-90767",
      "aliases": [
        "CVE-2026-90767",
        "GHSA-p3v3-74gc-jh5f"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/froxlor/froxlor",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "143b6ee634a4b9c237437b4b1206c7b733b86d95"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.3.12"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.3.12"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "2.3.11",
            "2.3.10",
            "2.3.9",
            "2.3.8",
            "2.3.7",
            "2.3.6",
            "2.3.5",
            "2.3.4",
            "2.3.3",
            "2.3.2",
            "2.3.1",
            "2.3.0",
            "2.3.0-rc1",
            "2.2.0-rc1",
            "2.1.4",
            "2.1.3",
            "2.1.2",
            "2.1.1",
            "2.1.0",
            "2.1.0-rc3",
            "2.1.0-rc2",
            "2.1.0-rc1",
            "2.1.0-beta2",
            "2.1.0-beta1",
            "2.0.24",
            "2.0.23",
            "2.0.22",
            "2.0.21",
            "2.0.20",
            "2.0.19",
            "2.0.18",
            "2.0.17",
            "2.0.16",
            "2.0.15",
            "2.0.14",
            "2.0.13",
            "2.0.12",
            "2.0.11",
            "2.0.10",
            "2.0.9",
            "2.0.8",
            "2.0.7",
            "2.0.6",
            "2.0.5",
            "2.0.4",
            "2.0.3",
            "2.0.2",
            "2.0.1",
            "0.10.33",
            "0.10.32",
            "0.10.31",
            "0.10.30",
            "0.10.29.1",
            "0.10.29",
            "0.10.28",
            "0.10.27",
            "0.10.26",
            "0.10.25",
            "0.10.24",
            "0.10.23.1",
            "0.10.23",
            "0.10.22",
            "0.10.21",
            "0.10.20",
            "0.10.19",
            "0.10.18",
            "0.10.17",
            "0.10.16",
            "0.10.15",
            "0.10.14",
            "0.10.13",
            "0.10.12",
            "0.10.11",
            "0.10.10",
            "0.10.9",
            "0.10.8",
            "0.10.7",
            "0.10.6",
            "0.10.5",
            "0.10.4",
            "0.10.3",
            "0.10.2",
            "0.10.1",
            "0.10.0",
            "0.10.0-rc2",
            "0.10.0-rc1",
            "0.9.39.5",
            "0.9.39.4",
            "0.9.39.3",
            "0.9.39.2",
            "0.9.39.1",
            "0.9.39",
            "0.9.38.8",
            "0.9.38.7",
            "0.9.38.6",
            "0.9.38.5",
            "0.9.38.4",
            "0.9.38.3",
            "0.9.38.2",
            "0.9.38.1",
            "0.9.38",
            "0.9.38-rc2",
            "0.9.38-rc1",
            "0.9.37",
            "0.9.37-rc1",
            "0.9.36",
            "0.9.35.1",
            "0.9.35",
            "0.9.35-rc1",
            "0.9.34.2",
            "0.9.34.1",
            "0.9.33-rc3",
            "0.9.33-rc2",
            "0.9.33-rc1",
            "0.9.32",
            "0.9.32-rc2",
            "0.9.32-rc1",
            "0.9.31-rc1",
            "0.9.30",
            "0.9.30-rc1",
            "0.9.29",
            "0.9.29-rc1",
            "0.9.28.1",
            "0.9.28",
            "0.9.28-rc1",
            "0.9.27",
            "0.9.27-rc1",
            "0.9.26",
            "0.9.26-rc1",
            "0.9.25",
            "0.9.25-rc1",
            "0.9.24",
            "0.9.24-rc1",
            "0.9.23",
            "0.9.23-rc1",
            "0.9.22",
            "0.9.22-rc1",
            "0.9.21",
            "0.9.20.1",
            "0.9.20",
            "0.9.19",
            "0.9.18.1",
            "0.9.18"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90767.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:41.336301148Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90767.json",
        "https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90767",
        "https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys",
        "https://github.com/froxlor/Froxlor",
        "https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.php",
        "https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.php"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-93"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90767.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90767",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 509055,
  "published_at": "2026-09-13T10:45:37.369+00:00"
}