CVE-2026-41228
Froxlor is open source server administration software.
Published Apr 23, 2026 · updated Jun 17, 2026 · froxlor froxlor
Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint (and ) does not validate the parameter against the list of available language files. An authenticated customer can set to a path traversal payload (e.g., ), which is stored in the database. On subsequent requests, constructs a file path using this value and executes it via , achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 23, 2026 · NIST NVD
Detected
Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint (and ) does not validate the parameter against the list of available language files. An authenticated customer can set to a path traversal payload (e.g., ), which is stored in the database. On subsequent requests, constructs a file path using this value and executes it via , achieving arbitrary
Jun 17, 2026 · NIST NVD
Updated
Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint (and ) does not validate the parameter against the list of available language files. An authenticated customer can set to a path traversal payload (e.g., ), which is stored in the database. On subsequent requests, constructs a file path using this value and executes it via , achieving arbitrary
Affected
- cpe froxlor/froxlorversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41228
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41228
Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint (and ) does not validate the parameter against the list of available language files. An authenticated customer can set `def_lan
nvd.nist.gov