Froxlor CVE-2026-41229

Attacker must have authenticated administrator access to Froxlor with the change_serversettings permission explicitly granted. This permission controls the ability to add or update MySQL server configurations via the admin panel or API. Default Froxlor installations typically grant this permission to the primary administrator account. Multi-admin deployments using role-based access control may limit this permission to senior administrators. The vulnerability affects the API endpoint for MySQL server management, which must be accessible to the authenticated attacker. No non-default configuration is required - all Froxlor installations prior to 2.3.6 with default settings are exploitable once the privilege requirement is met. The attack complexity is low (AC:L) because no race conditions, timing, or other complicating factors are involved beyond obtaining the necessary authentication credentials and permission level.

This vulnerability presents critical risk despite requiring high privileges (PR:H). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C indicates network-accessible exploitation with low complexity, no user interaction, and crucially a scope change from Changed to High impact across all CIA triad elements. The scope change reflects that an attacker authenticated as an admin can achieve code execution as the web server system user, potentially compromising the entire hosting environment beyond the application itself. Real-world risk assessment: HIGH for organizations using Froxlor where multiple administrators exist or where admin credentials could be compromised through phishing or credential reuse. MEDIUM-LOW for single-administrator deployments with strong authentication controls. No EPSS score, KEV status, or POC availability data provided, but GitHub commit 3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae shows the fix is a straightforward escaping implementation, suggesting exploitation is technically simple once admin access is obtained. The persistent nature of the injection (executes on every request) makes this particularly dangerous for lateral movement scenarios where an attacker chains this with an authentication bypass or privilege escalation vulnerability.

An attacker who has compromised administrator credentials (via phishing, credential stuffing, or an unrelated vulnerability) authenticates to the Froxlor admin panel and calls the MySQL server management API with a crafted privileged_user parameter containing PHP code: user'; system($_GET['cmd']); //. This malicious string is written unescaped into lib/userdata.inc.php, breaking out of the quoted string context and injecting executable PHP. On the next request to any Froxlor page, the injected code executes as the web server user, providing persistent remote code execution. The attacker can now run arbitrary system commands, read database credentials from the now-compromised configuration file, pivot to managed hosting accounts, or establish persistence mechanisms.