CVE-2026-109960 is a High severity (CVSS 7.7) stored cross-site scripting flaw in Froxlor 2.0.0 before 2.3.14. A hosting customer can save script in their theme value, and it runs when an administrator opens the customer overview. Upgrade to Froxlor 2.3.14, which fixes it.
What's affected
The record says Froxlor 2.0.0 before 2.3.14 is affected. The GitHub advisory lists affected versions as 2.3.13 and earlier and patched version 2.3.14. The weakness is CWE-79, cross-site scripting.
The advisory explains the cause. The theme field accepted characters such as angle brackets and quotes, and it was not checked against the list of installed themes the way the language field is. Later, the customer listing printed the stored value through a template filter that turns off HTML escaping, but only when the optional Theme column is shown to the administrator. Script then runs in the administrator's logged in session.
The record notes that this can be used to create administrator accounts or change server settings. Severity differs by source: the record gives 7.7 (High) and VulnCheck gives 8.7 (High). The advisory is labelled High.
How to check if you're exposed
Check the version shown in the admin panel footer, or read it from the install directory.
grep -rn "version" /var/www/froxlor/lib/Froxlor/Froxlor.php | head
Adjust the path to your install. If the version is 2.3.13 or lower in the 2.x line, you are in range.
Next, look at your data. Query the customer records for theme values that contain angle brackets or quotes. A legitimate theme name is a short plain word. Anything else deserves a look, and you should treat it as a sign of an attempt. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade Froxlor to 2.3.14 or later.
- Check customer theme values in the database and reset any that are not the name of an installed theme.
- Until you upgrade, turn off the optional Theme column in the customer overview so stored values are not printed there.
- If you suspect an administrator opened a poisoned page, review the list of admin accounts and recent setting changes, and rotate administrator passwords and API keys.
- Limit who can sign up for hosting accounts and review new customers on shared panels.
Why it matters
Stored XSS is dangerous when it crosses a privilege boundary. A customer can only change their own profile, but the page that shows all customers is read by someone with far more power. Script that runs there acts with the administrator's rights, and the panel's own forms and tokens become tools for the attacker.
The fix pattern is old and reliable: validate input against what is allowed, and escape on output. The advisory points out that the code did neither for this one field. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Who is the target of this attack?
The administrator. The customer plants the value, and it runs when an administrator views the customer overview with the Theme column enabled.
What is the fixed version?
Froxlor 2.3.14, per the GitHub advisory.
Sources
Last reviewed: 18 October 2026.
