HTML Injection Vulnerability in Froxlor Package
Summary
CVE-2025-48958: Froxlor has an HTML Injection Vulnerability. Affects froxlor/froxlor versions < 2.2.6. Fixed in 2.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Froxlor is an open-source server management panel that allows users to manage their web hosting services efficiently. It provides functionalities such as managing domains, email accounts, and databases, making it a popular choice for web hosting providers. However, Froxlor has been found to have an HTML Injection vulnerability that can be exploited through user input, potentially leading to serious security issues.
Vulnerability Detail
An HTML Injection vulnerability exists in the customer account portal of Froxlor, specifically in the email section where users can create email addresses. By manipulating the 'domain' field with an HTML payload, an attacker can inject malicious HTML that is reflected on an error page. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability is classified as having a moderate severity with a CVSS score of 5.5, as it can be exploited without authentication.
How To Fix
Minimum fixed version
2.2.6
This is the first release that contains the fix.
composer require froxlor/froxlor:2.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict user input in the email section by validating the input format and rejecting any entries that contain HTML tags. This can be done by implementing a regex pattern to allow only valid email formats.
Conclusion
The HTML Injection vulnerability in Froxlor poses a significant risk to users of the customer account portal. By updating to the patched version and implementing proper input validation, organizations can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for froxlor/froxlor →
FAQ
HTML Injection is a type of security vulnerability that allows an attacker to inject malicious HTML code into a web application, potentially leading to various attacks such as phishing.
Users may be tricked into clicking malicious links that lead to phishing sites, resulting in credential theft and exposure to malware.
Yes, the vulnerability has been patched in version 2.2.6 of the Froxlor package.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Implement input validation to restrict HTML tags in user inputs as a temporary measure until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
