Froxlor CVE-2026-41231

Requires authenticated customer account access to the Froxlor administration panel. The Froxlor installation must have the ExportCron scheduled task configured and running with root privileges (common default for hosting environments to enable backup and export features across customer file boundaries). Exploitation requires the attacker to create symbolic links in their accessible filesystem locations (typically the customer's home directory or web root) pointing to target system directories. Attack success depends on timing-the symlink must exist when ExportCron processes the export job. Attack complexity is high (CVSS AC:H) because the attacker must predict or influence the export path construction and coordinate with the cron schedule. However, limiting factors are significant: not all Froxlor deployments run ExportCron as root (some use restricted service accounts), the feature may be disabled in security-hardened configurations, and filesystem permissions or mandatory access controls (SELinux/AppArmor) may prevent symlink creation or following. The vulnerability is specific to installations where customers have file-level access combined with administrative panel features-typical in shared hosting but less common in managed or containerized environments.

The CVSS score of 7.5 (High) reflects network attack vector with high attack complexity, requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability. However, real-world risk assessment requires nuanced analysis. Attack complexity is rated high (AC:H) likely because exploitation requires: (1) authenticated customer account, (2) timing the symlink creation before the ExportCron executes, (3) predicting the export path construction, and (4) the cron running as root (deployment-dependent). The privilege requirement (PR:L) indicates any authenticated customer can attempt exploitation-a significant concern in multi-tenant hosting environments where Froxlor is commonly deployed. The technical impact is severe: arbitrary directory ownership changes could lead to complete system compromise by taking ownership of /etc/shadow for password changes, /root/.ssh for SSH access, or web server directories for code injection. EPSS score unavailable-likely because this is a 2026 CVE identifier (future year, possibly data entry error or pre-disclosure). No CISA KEV listing suggests no confirmed widespread exploitation, but the vulnerability class (symlink following in SUID/root processes) has extensive exploitation history. This represents a regression vulnerability where incomplete fix application creates exploitable gaps-a pattern that often receives focused attention from attackers familiar with the original CVE-2023-6069. Priority should be HIGH for any Froxlor installation in multi-customer hosting environments where the ExportCron runs with elevated privileges.

An authenticated customer with a basic hosting account on a Froxlor-managed server creates a symbolic link in their home directory pointing to /etc/shadow. They then trigger a data export operation through the Froxlor panel, specifying the symlink path as the export destination. When the scheduled ExportCron task executes as root, it constructs the export path from the customer's input without validating symlinks, then runs 'chown -R customer:customer' on the resolved path-following the symlink to /etc/shadow. The attacker now owns the system password file, can modify root credentials, and achieves full system compromise. From there, they can pivot to other customer accounts, exfiltrate data from the entire hosting infrastructure, or establish persistent backdoor access.