CVE-2026-109961 is a High severity (CVSS 8.5) newline injection in Froxlor 0.10.0 before 2.3.14. A customer can add lines to a root-owned group database through the Ftps.add API, which opens a path to local privilege escalation. Upgrade to Froxlor 2.3.14, the patched version.
What's affected
The record says Froxlor 0.10.0 before 2.3.14 is affected. The GitHub advisory lists affected versions as 2.3.13 and earlier and patched version 2.3.14, so the two agree on the fix. The weakness is CWE-74, injection into output that another component interprets.
According to the advisory, the additional_members parameter of the customer accessible Ftps.add API is not validated. A newline inside the value survives. A scheduled job that runs as root, the one that rebuilds the extra users files, writes each group line without cleaning the members field. An embedded newline therefore starts a new line in the group file at /var/lib/extrausers/group.
Severity differs by source. The record gives 8.5 (High). VulnCheck gives 8.4 (High). The advisory is labelled High and describes the guaranteed impact as arbitrary lines in a root-owned authentication database, with privilege escalation as a conditional outcome.
How to check if you're exposed
Check the Froxlor version in the admin panel, or from the install directory. Anything at 2.3.13 or lower is in range.
Then inspect the group file on hosts that use the extrausers module.
cat /var/lib/extrausers/group
Look for entries you do not recognise, such as groups with low numbered ids or groups with login capable members that were not set up by you. Compare against a backup if you have one. Also check the stored FTP group member values in the Froxlor database for embedded line breaks. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade Froxlor to 2.3.14 or later.
- Review the NSS group file and the Froxlor FTP records for entries that do not belong, and remove them.
- If you find injected entries, treat the host as possibly compromised: check group memberships, sudo rules and recent logins, and rotate credentials.
- Limit customer access to the API where you can, and avoid giving customers more than the features they need.
- Add file integrity monitoring for the group database on shared hosting servers.
Why it matters
This is a classic case of data crossing a trust boundary without being cleaned. The panel treats the field as a plain list of names, and a root job writes it into a file that the whole operating system reads for identity decisions. A single newline character changes the meaning of the file.
The advisory notes that the nearby password file branch already cleans its input, while the group branch does not. Inconsistent handling inside one code path is a good clue when you review similar tools. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Which Froxlor version fixes CVE-2026-109961?
2.3.14, according to the GitHub advisory.
Why is a newline dangerous here?
The group file uses one line per entry. A newline in a field written by a root job creates a new entry that the system will trust.
Sources
Last reviewed: 18 October 2026.
