Froxlor Vulnerability Grants Root Ownership of Arbitrary Directories

A critical vulnerability, CVE-2026-41231, impacts Froxlor, an open-source server administration software. The National Vulnerability Database reports that prior to version 2.3.6, the DataDump.add() function constructs an export destination path using user-supplied input without proper validation. Crucially, it bypasses the symlink validation intended to prevent such issues, which was implemented in other customer-facing path operations.

This flaw allows a low-privileged user to craft a path that, when processed by the ExportCron — which often runs as root — leads to chown -R being executed on an arbitrary symlink target. The attacker can then seize ownership of any directory on the system, granting them significant control. The National Vulnerability Database rates this with a CVSS score of 7.5 (HIGH).

Froxlor users running versions prior to 2.3.6 are at severe risk. This isn’t just a bypass; it’s a direct path to privilege escalation and system compromise. Defenders need to recognize that this isn’t a theoretical concern; it’s a practical attack vector that can be exploited by any authenticated user on the system.