CVE-2026-41231 Details
Description
Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes `chown -R` on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.
A vulnerability in Froxlor's DataDump.add() function prior to version 2.3.6 allows for an incomplete symlink validation, leading to unauthorized ownership of directories. The issue arises because the export destination path is constructed from user input without proper validation, enabling customers to manipulate the path and take ownership of arbitrary directories when the ExportCron runs as root. This vulnerability affects Froxlor versions through 2.1.0.
Users can update to Froxlor version 2.3.6, which includes the necessary fix. Instructions for downloading this version are available on the Froxlor GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-75h4-c557-j89r | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/froxlor/froxlor/commit/2987b0e8806ef12b532410050ad76d13d673a87d | [email protected] | Patch |
| https://github.com/froxlor/froxlor/releases/tag/2.3.6 | [email protected] | Release Notes |
| https://github.com/froxlor/froxlor/security/advisories/GHSA-75h4-c557-j89r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| froxlor froxlor | < 2.3.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |