Vulnerability record · CVE-2026-41229 · published 23 April 2026

CVE-2026-41229: Froxlor code injection vulnerability

Froxlor · Froxlor

Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the API, the `privileged_user` parameter (which has no input validation) is written unescaped into `lib/userdata.inc.php`. Since this file is `require`d on every request via `Database::getDB()`, an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.

9.1 CVSS 3.1 Critical EPSS 0.69% · top 49.1% CWE-94 · Code injection

9.1CVSS 3.1 base score

0.69%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Froxlor Froxlor

References

Link	Tags
https://github.com/froxlor/froxlor/commit/3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae	Patch
https://github.com/froxlor/froxlor/releases/tag/2.3.6	Release Notes
https://github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-rjv8	ExploitMitigationVendor Advisory
https://github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-rjv8	ExploitMitigationVendor Advisory

Track CVE-2026-41229 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-41228Froxlor php remote file inclusion vulnerabilityFroxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does…EPSS 0.75%23 Apr 2026 9.8CVE-2023-3173Froxlor improper restriction of authentication attempts vulnerabilityImproper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.EPSS 1.1%9 Jun 2023 9.8CVE-2023-1307Froxlor vulnerabilityAuthentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.EPSS 1.1%10 Mar 2023 9.8CVE-2021-42325Froxlor sql injection vulnerabilityFroxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.EPSS 12%12 Oct 2021 9.8CVE-2015-5959Froxlor information exposure vulnerabilityFroxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.…EPSS 3.1%6 Sep 2017 9.8CVE-2016-5100Froxlor vulnerabilityFroxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset…EPSS 1.9%13 Feb 2017 9.1CVE-2026-26279Froxlor os command injection vulnerabilityFroxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disable…EPSS 1.1%3 Mar 2026 8.8CVE-2023-6069Froxlor link following vulnerabilityImproper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.EPSS 0.83%10 Nov 2023

Source: NIST National Vulnerability Database (record CVE-2026-41229), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.