Froxlor Critical RCE: Unsanitized Admin Input Leads to Persistent Code Execution

The National Vulnerability Database has disclosed CVE-2026-41229, a critical remote code execution (RCE) vulnerability in Froxlor, an open-source server administration software. Prior to version 2.3.6, the PhpHelper::parseArrayToString() function fails to properly escape single quotes when writing string values into PHP string literals.

This flaw becomes exploitable when an administrator with change_serversettings permission adds or updates a MySQL server via the API. The privileged_user parameter, which lacks input validation, is written unescaped into lib/userdata.inc.php. Since this file is required on every request via Database::getDB(), an attacker can inject arbitrary PHP code. This code then executes as the web server user on every subsequent page load, granting persistent control.

With a CVSS score of 9.1 (CRITICAL), this vulnerability represents a severe threat. It allows for complete system compromise and persistent access. Defenders running Froxlor instances must prioritize patching to version 2.3.6 immediately to prevent attackers from establishing a backdoor on their web servers. The attacker’s calculus here is simple: leverage administrative access to achieve silent, persistent RCE.