medium6.5
CVE-2026-100719
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes.
Impact
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.
Affected products
| Product | Affected versions |
|---|---|
| Froxlor | before 2.3.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.