CVE-2026-90767
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-93
Neutralización incorrecta de secuencias de retornos de carro y saltos de linea (CRLF)
Fecha de publicación:
13/09/2026
Última modificación:
23/09/2026
Descripción
*** Pendiente de traducción *** Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Impacto
Puntuación base 4.0
7.10
Gravedad 4.0
ALTA
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/froxlor/Froxlor
- https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.php
- https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.php
- https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f
- https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys
- https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f