PT-2026-44907 · Froxlor · Froxlor

Larlarua · Published 2026-05-29 · Updated 2026-06-08 · CVE-2026-41236

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor version 2.3.6

Description A symlink-following flaw exists in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to ~/.ssh/authorized keys within a customer-controlled home directory without verifying if the target path is a symbolic link. An attacker with a shell-enabled customer account can replace ~/.ssh/authorized keys with a symlink pointing to /root/.ssh/authorized keys. When the privileged cron task executes the SshKeys::generateFiles() function and subsequently appends the key, the attacker-supplied key is added to the root user's authorized key file, granting the attacker root SSH access. This process involves the SshKeys.add API call and the makeCorrectFile() function, which fails to resolve or reject symlinks.

Recommendations Update to version 2.3.7.

Exploit

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-41236

GHSA-MQ5V-PXPM-8JW2

Affected Products

Froxlor

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41236.json · Exploit
• 🔥 https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41236 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41236 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq5v-pxpm-8jw2 · Vendor Advisory
• https://github.com/froxlor/froxlor · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.7 · Note
• https://t.me/CVEtracker/55862 · Telegram Post
• https://t.me/cveNotify/166546 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2062691814964945206 · Twitter Post