CVE-2026-41235 Details

An authorization bypass vulnerability has been identified in Froxlor version 2.3.6, allowing authenticated customers with shell delegation enabled to assign arbitrary shells to FTP users. The issue arises because the server-side FTP account handlers do not enforce the approved shell whitelist when processing add or edit requests. As a result, an attacker can submit a shell like '/bin/bash', which is then propagated into the system account database, leading to unauthorized shell access on the host. This vulnerability is particularly impactful in environments using the default 'nssextrausers' integration, where the exploited shell assignment grants real host shell access.

Users can upgrade to Froxlor version 2.3.7, which addresses this vulnerability by enforcing the approved shell whitelist in the FTP account management process.