CVE-2026-41228: Froxlor path traversal in def_language API parameter leading to remote code execution
Froxlor versions before 2.3.6 do not validate the def_language parameter in the Customers.update and Admins.update API methods, which allows a stored path traversal value. The advisory states that this can lead to arbitrary PHP code execution as the web server user, and the record fixes it in 2.3.6. CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted.
Overview
Froxlor is open source server administration software. According to the record, the API methods Customers.update and Admins.update do not validate the def_language parameter against the list of available language files. A stored path traversal value can then be loaded by the language loader. Version 2.3.6 fixes the issue.
Impact
- The advisory describes arbitrary PHP code execution as the web server user, reached through a stored value that is later loaded by the language loader.
- The record classifies the weakness as CWE-98.
- The record lists a critical severity, with a score of 9.9 from one provider and 10 from another.
Affected products and versions
- Froxlor (recorded as Froxlor Froxlor) before 2.3.6.
- The fix is available in 2.3.6.
Exploitation status
- The CISA KEV catalogue does not list this CVE in the record, so active exploitation is not confirmed by that source.
- No confirmed exploitation appears in the sources consulted.
- The SSVC exploitation field is recorded as proof of concept activity. The record does not identify a specific public proof of concept.
Remediation and mitigation
- Upgrade Froxlor to 2.3.6 or later, as indicated by the release and advisory references.
- Review the vendor security advisory for its mitigation guidance.
- Until patching is complete, limit which customer and administrator accounts can use the API, since the advisory states that an authenticated customer can trigger the issue.
Detection guidance
- Review stored language preference values for entries that are not valid language identifiers, especially values containing directory separators or parent directory segments.
- Audit API activity for update requests against customer and administrator objects.
- Check web-accessible and customer directories for unexpected PHP files.
Limitations of the available information
- The record does not describe exploitation prerequisites beyond authenticated access.
- The record does not confirm whether every configuration is reachable in the same way.
- The available version information only gives the boundary 2.3.6, so intermediate versions cannot be assessed from the record.
Frequently asked questions
Which Froxlor versions are affected by CVE-2026-41228?
The record lists Froxlor versions before 2.3.6 as affected. The fix is available in 2.3.6.
Is this vulnerability known to be actively exploited?
CISA KEV does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as proof of concept activity.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.