PT-2026-34632 · Froxlor · Froxlor

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-41228

Mitre

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint Customers.update (and Admins.update) does not validate the def language parameter against the list of available language files. An authenticated customer can set def language to a path traversal payload (e.g., ../../../../../var/customers/webs/customer1/evil), which is stored in the database. On subsequent requests, Language::loadLanguage() constructs a file path using this value and executes it via require, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-41228

Affected Products

Froxlor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41228 · Security Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 · Note
• https://github.com/froxlor/froxlor/commit/bc5e6dbaa90e6f3573129da640595e8c770e1d0c · Note
• https://github.com/froxlor/froxlor/security/advisories/GHSA-w59f-67xm-rxx7 · Note