CVE-2026-26279: Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

A typo in Froxlor’s input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings — including shell metacharacters — in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution.