CVE-2025-48958 Froxlor has an HTML Injection Vulnerability

What is CVE-2025-48958?

CVE-2025-48958 is a medium-severity cross-site scripting vulnerability in Froxlor, published on 2 Jun 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.

Weakness: CWE-79

Which versions are affected by CVE-2025-48958?

2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.

Products include Froxlor Froxlor.

How do I fix CVE-2025-48958?

Upgrade froxlor/froxlor to 2.2.6 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-48958 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48958 exists.

Other vulnerabilities in Froxlor

• CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution Critical 10.0
• CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor Critical 9.9
• CVE-2023-0671 Code Injection in froxlor/froxlor Critical 9.9
• CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor Critical 9.8
• CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-26xq-m8xw-6373.