PT-2026-34632 · Froxlor · Froxlor

Offset · Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41228

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.6

Description The API endpoints 'Customers.update' and 'Admins.update' fail to validate the def language parameter against available language files. An authenticated customer can provide a path traversal payload in the def language parameter, which is then stored in the database. The Language::loadLanguage() function subsequently uses this value to construct a file path and executes it via require, allowing for arbitrary PHP code execution as the web server user.

Recommendations Update to version 2.3.6.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-41228

GHSA-W59F-67XM-RXX7

Affected Products

Froxlor

References · 9

• 🔥 https://github.com/froxlor/froxlor/security/advisories/GHSA-w59f-67xm-rxx7 · Exploit
• https://github.com/froxlor/froxlor/commit/bc5e6dbaa90e6f3573129da640595e8c770e1d0c · Patch
• https://osv.dev/vulnerability/GHSA-w59f-67xm-rxx7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41228 · Security Note
• https://github.com/froxlor/froxlor · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 · Note
• https://twitter.com/CVEnew/status/2047359889102557234 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2047284373699846550 · Twitter Post
• https://twitter.com/CCBalert/status/2047291103582331260 · Twitter Post