CVE-2026-41229 - Vulnerability Analysis

Overview

Froxlor < 2.3.6 contains a code injection vulnerability caused by unescaped single quotes in PhpHelper::parseArrayToString() when writing the privileged_user parameter in lib/userdata.inc.php, letting attackers with change_serversettings permission execute arbitrary PHP code as the web server user, exploit requires admin privileges.

Severity & Score

Impact

Attackers with admin privileges can execute arbitrary PHP code as the web server user, leading to full server compromise.

Mitigation

Update to version 2.3.6 or later.

References

• https://github.com/froxlor/froxlor/commit/3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae
• https://github.com/froxlor/froxlor/releases/tag/2.3.6
• https://github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-rjv8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner