Froxlor’s CVSS 10 Flaw Turns Config Files into Persistent Backdoors

Security researchers disclosed two critical Froxlor vulnerabilities: an API validation gap that allows authenticated users to perform path traversal via language settings leading to arbitrary PHP code execution, and improper escaping when writing userdata.inc.php that enables persistent PHP backdoors executed on every request. The report assigns a maximum-severity CVSS 10 to the most severe issue and recommends fixes including adopting the Web UI's strict language validation, properly escaping backslashes and single quotes, using nowdoc syntax for config strings, and adding input validation for sensitive fields.