{"action":"Upgrade froxlor/froxlor to 2.3.4 or later.","affected":[{"fixed":"2.3.4","introduced":"0"}],"component":"froxlor/froxlor","cve_ids":["CVE-2026-26279"],"ecosystem":"Packagist","epss":0.00852,"exploited":false,"fixed_versions":["2.3.4"],"ghsa_id":"GHSA-33mp-8p67-xj7c","id":"tcs_01M5KESH7REGXKV1SJYEWFZSMF","modified_at":"2026-03-04T15:12:09.398539Z","published_at":"2026-03-03T17:40:19Z","references":["https://osv.dev/vulnerability/GHSA-33mp-8p67-xj7c","https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c","https://nvd.nist.gov/vuln/detail/CVE-2026-26279","https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343","https://github.com/froxlor/froxlor","https://github.com/froxlor/froxlor/releases/tag/2.3.4"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-33mp-8p67-xj7c","url":"https://osv.dev/vulnerability/GHSA-33mp-8p67-xj7c"}],"summary":"Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection"}