CVE-2023-0315: Froxlor command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityNetwork-reachable command injection with high impact and public exploit code, though it requires an authenticated low-privileged account and is not in KEV.

What it is

Froxlor, a server management panel, contains a command injection flaw (CWE-77) in versions prior to 2.0.8. An authenticated attacker can inject operating system commands that execute on the host, and public exploit write-ups exist for 2.0.3 and 2.0.6. The issue matters because Froxlor typically runs with elevated privileges on hosting infrastructure.

Impact

An attacker with a valid low-privileged account gains arbitrary command execution on the server, leading to full compromise of confidentiality, integrity and availability of the host and any hosted data.

Attack surface

Reachable over the network through the Froxlor web interface; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N). The specific vulnerable endpoint is not named in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.97653, 99.9th percentile) and references include an Exploit-tagged huntr report plus Packet Storm RCE write-ups for 2.0.3 and 2.0.6, indicating public exploit code is available.

What to do

• Upgrade Froxlor to 2.0.8 or later, applying commit 090cfc26f2722ac3036cc7fd1861955bc36f065a.
• Restrict access to the Froxlor admin interface to trusted networks or VPN.
• Review and minimize accounts with panel access; remove unused or stale users.
• Run the Froxlor web service and PHP process under a least-privileged OS account with no unnecessary shell access.
• Monitor for unexpected child processes spawned by the web server or PHP-FPM.

Detection

• Alert on web server or PHP-FPM processes spawning shells (sh, bash) or system utilities such as curl, wget, nc.
• Audit Froxlor application and web server logs for requests containing shell metacharacters (;, |, &&, $(), backticks).
• Baseline and monitor outbound network connections originating from the Froxlor host.
• Track file creation or modification in web-accessible directories and system paths by the Froxlor service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.