CVE-2026-41235: high-severity vulnerability in froxlor
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.2%
Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
froxlor · froxlorRelated CVEs — froxlor
In the same product, most dangerous first.
CVE-2026-54348HIGHFroxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationEPSS 0.7%CVE-2026-113678CRITICALFroxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic CronEPSS 0.6%CVE-2026-62988CRITICALFroxlor: Credential and 2FA secret disclosure via Froxlor API endpointsEPSS 0.6%CVE-2026-30932HIGHFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIEPSS 0.6%CVE-2026-100714CRITICALFroxlor before 2.3.12 Command Injection via letsencryptchallengepathEPSS 0.5%CVE-2026-41228CRITICALFroxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code ExecutionEPSS 0.5%