CVE-2026-41228 PUBLISHED

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

Assigner: GitHub_M
Reserved: 18.04.2026 Published: 23.04.2026 Updated: 23.04.2026

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint Customers.update (and Admins.update) does not validate the def_language parameter against the list of available language files. An authenticated customer can set def_language to a path traversal payload (e.g., ../../../../../var/customers/webs/customer1/evil), which is stored in the database. On subsequent requests, Language::loadLanguage() constructs a file path using this value and executes it via require, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor froxlor
Product froxlor
Versions
  • Version < 2.3.6 is affected

References

Problem Types

  • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE