CVE Intelligence
Analysis AI-assisted

CVE-2026-41229: Froxlor PHP Code Injection via MySQL Server API

Froxlor versions before 2.3.6 do not escape single quotes when writing values into a generated PHP file, and the privileged_user parameter of the MySQL server API is written without input validation. An administrator with the change_serversettings permission can therefore cause arbitrary PHP code to run as the web server user. The record indicates that version 2.3.6 contains the patch.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Froxlor is open source server administration software. According to the advisory, versions before 2.3.6 do not escape single quotes when writing string values into a generated PHP configuration file. This allows PHP code injection through the MySQL server API.

Impact

  • The record describes arbitrary PHP code execution as the web server user.
  • Because the generated file is loaded on every request, injected code would run on each subsequent page load.
  • The record assigns a CVSS score of 9.1 (critical) with high confidentiality, integrity and availability impact. The vector requires high privileges and no user interaction.

Affected products and versions

  • Product: Froxlor Froxlor.
  • Affected: versions before 2.3.6.
  • Fixed in: 2.3.6, according to the release reference.

Exploitation status

The record shows this CVE is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted. The SSVC exploitation field in the record is set to poc. The GHSA reference is tagged as an exploit reference, but the record does not describe its contents.

Remediation and mitigation

  • Upgrade Froxlor to version 2.3.6 or later.
  • Review the GitHub Security Advisory for the vendor's mitigation guidance.
  • Limit the change_serversettings permission to trusted administrators and review who holds it.
  • Review MySQL server entries added or changed through the API, especially the privileged_user values.

Detection guidance

  • Review audit logs and recent changes to MySQL server entries made through the API.
  • After upgrading, compare the generated userdata include file with a known-good state and look for unexpected content.
  • Monitor web server and administrative API logs for unusual activity from administrator accounts.

Limitations of the available information

  • The record gives only the boundary 'before 2.3.6', so the lower bound of the affected range is unknown.
  • The content of the mitigation guidance in the GHSA advisory is not included in the record.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.
  • The record does not confirm whether public exploit code exists.

Frequently asked questions

Is CVE-2026-41229 being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The SSVC exploitation field is recorded as poc.

Which version fixes this issue?

According to the release reference, version 2.3.6 contains the patch, so upgrading to 2.3.6 or later is the recommended action.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.