Critical Froxlor Bug: Authenticated Code Execution via Language File Path Traversal

The National Vulnerability Database has disclosed CVE-2026-41228, a critical vulnerability in Froxlor, an open-source server administration software. Prior to version 2.3.6, the Customers.update and Admins.update API endpoints fail to properly validate the def_language parameter. This oversight allows an authenticated user to inject a path traversal payload, such as ../../../../../var/customers/webs/customer1/evil, which is then stored in the database.

Subsequent requests trigger Language::loadLanguage(), which constructs a file path using the malicious def_language value. This path is then executed via require, leading to arbitrary PHP code execution under the privileges of the web server user. The National Vulnerability Database assigns this a CVSS score of 9.9 (CRITICAL), highlighting the severe impact and ease of exploitation.

This flaw represents a direct path to full system compromise for attackers who gain even low-level authenticated access. Defenders running Froxlor instances must prioritize patching to version 2.3.6 immediately. The attacker’s calculus here is simple: leverage a common web vulnerability pattern (path traversal leading to arbitrary file inclusion) to achieve maximum impact with minimal effort once inside the perimeter. It’s a direct route to persistence and data exfiltration.