How to fix CVE-2026-41228?

Within 24 hours: Identify all Froxlor installations and document current versions. Within 7 days: Upgrade all Froxlor instances to version 2.3.6 or later; restrict API access to trusted administrative users only pending patching. Within 30 days: Audit API access logs for the Customers.update and Admins.update endpoints to identify unauthorized language parameter modifications, and reset credentials for any accounts with suspicious activity.

Is Froxlor affected by CVE-2026-41228?

Froxlor server administration software versions before 2.3.6 contain a critical authenticated remote code execution vulnerability in the API language parameter that allows administrators or customers with API access to execute arbitrary code on the server.

Froxlor CVE-2026-41228

EUVD-2026-25176 CRITICAL

PHP Remote File Inclusion (CWE-98)

2026-04-23 GitHub_M

PHP RCE Path Traversal Lfi

9.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 16:27 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:47 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

CVSS changed

Apr 23, 2026 - 04:36 NVD

10.0 (CRITICAL) 9.9 (CRITICAL)

DescriptionNVD

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint Customers.update (and Admins.update) does not validate the def_language parameter against the list of available language files. An authenticated customer can set def_language to a path traversal payload (e.g., ../../../../../var/customers/webs/customer1/evil), which is stored in the database. On subsequent requests, Language::loadLanguage() constructs a file path using this value and executes it via require, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

AnalysisAI

Authenticated customers can achieve remote code execution in Froxlor server administration software versions prior to 2.3.6 through path traversal in the API's language parameter. By injecting malicious path traversal sequences into the def_language field via the Customers.update or Admins.update API endpoints, authenticated users can force the application to execute arbitrary PHP code as the web server user on subsequent requests. …

RemediationAI

Within 24 hours: Identify all Froxlor installations and document current versions. Within 7 days: Upgrade all Froxlor instances to version 2.3.6 or later; restrict API access to trusted administrative users only pending patching. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-41228 vulnerability details – vuln.today

Back

Froxlor CVE-2026-41228

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code