Froxlor Before 2.2.0 Insecure File Permissions Mysql Conf

Back www.vulncheck.com

Froxlor Before 2.2.0 Insecure File Permissions Mysql Conf

www.vulncheck.com • September 14, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Froxlor Exposes Database Credentials A critical vulnerability, CVE-2024-58383, affects Froxlor versions before 2.2.0, allowing unprivileged users on Debian 12 systems to access sensitive database credentials stored in /etc/pure-ftpd/db/mysql.conf. This file is generated with insecure permissions (0644), making it readable by any local user with command execution capabilities, including virtual users without SSH access. Attackers can exploit this vulnerability to gain administrative access to Froxlor and potentially escalate to root privileges. The vulnerability is particularly dangerous on multi-tenant hosting environments where multiple users share resources. Immediate action is recommended to mitigate risks, including applying vendor patches and restricting file permissions. The vulnerability was published on 2026-09-14, and while exploitation urgency is unclear, the potential for significant impact remains high. 2 sources 71

Extracted Entities

Platforms (2)

Vulnerabilities (2)

Insecure File Permissions Mysql Conf Vulnerability