What is the CVSS score of CVE-2026-41231?

CVE-2026-41231 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Froxlor are affected by CVE-2026-41231?

Froxlor versions before 2.3.6 contain a privilege escalation vulnerability that allows authenticated customers to gain unauthorized ownership of critical system directories through symlink…. A patch is available.

How to fix or mitigate CVE-2026-41231?

Within 24 hours: Identify all Froxlor instances and their current versions. Within 7 days: Upgrade all Froxlor installations to version 2.3.6 or later; verify ExportCron permissions and validate symlink protections in export paths. Within 30 days: Audit system directories modified by Froxlor processes; review customer access logs for suspicious export activities; implement file integrity monitoring on critical system directories.

Froxlor CVE-2026-41231

EUVD-2026-25182 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-04-23 GitHub_M

GHSA-75h4-c557-j89r

Authentication Bypass Froxlor

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 27, 2026 - 17:01 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 18:42 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:48 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 04:00 euvd

EUVD-2026-25182

Analysis Generated

Apr 23, 2026 - 04:00 vuln.today

CVE Published

Apr 23, 2026 - 03:52 nvd

HIGH 7.5

DescriptionGitHub Advisory

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add() constructs the export destination path from user-supplied input without passing the $fixed_homedir parameter to FileDir::makeCorrectDir(), bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes chown -R on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.

AnalysisAI

Symlink-based privilege escalation in Froxlor versions prior to 2.3.6 allows authenticated customers to gain ownership of arbitrary system directories. When the ExportCron executes as root, it performs 'chown -R' on user-controlled export paths that bypass symlink validation (introduced to fix CVE-2023-6069), enabling attackers to place symbolic links and hijack ownership of critical system files. This is a regression of the CVE-2023-6069 fix where DataDump.add() failed to apply the same symlink protections used elsewhere. EPSS data unavailable; no evidence of active exploitation (not in CISA KEV), but the specific vulnerability class (symlink following in privileged operations) has well-known exploitation patterns. Patch available in version 2.3.6.

Technical ContextAI

Froxlor is a server administration panel for managing web hosting resources. The vulnerability exists in the DataDump.add() function which constructs export destination paths from customer input. The code fails to pass the $fixed_homedir parameter to FileDir::makeCorrectDir(), a symlink validation mechanism that was added to other customer-facing path operations as remediation for CVE-2023-6069 (a prior path traversal/symlink vulnerability). CWE-59 (Improper Link Resolution Before File Access, 'Link Following') describes this class of Time-of-Check-Time-of-Use (TOCTOU) race conditions where an attacker creates symbolic links pointing to sensitive locations. When Froxlor's ExportCron scheduled task runs with root privileges to perform data exports, it executes 'chown -R' (recursive ownership change) on the path constructed from user input. Because symlink validation was bypassed, the chown operation follows the symlink to its target, changing ownership of whatever directory the customer's symlink points to-potentially /etc, /root, /var/www, or other critical system paths.

RemediationAI

Upgrade immediately to Froxlor version 2.3.6, released with the fix documented in commit 2987b0e8806ef12b532410050ad76d13d673a87d (https://github.com/froxlor/froxlor/commit/2987b0e8806ef12b532410050ad76d13d673a87d). The patch properly passes the $fixed_homedir parameter to FileDir::makeCorrectDir() to enforce symlink validation in DataDump.add(), closing the gap left by the CVE-2023-6069 remediation. Release notes and changelog available at https://github.com/froxlor/froxlor/releases/tag/2.3.6. If immediate patching is not feasible, implement compensating controls: disable the ExportCron feature entirely (blocks all data export functionality-impacts backup workflows), run ExportCron under a restricted service account rather than root (reduces impact to that account's permissions but may break legitimate file operations requiring elevated access), implement mandatory access controls (SELinux/AppArmor) to prevent ownership changes of system directories (adds operational complexity and requires policy development), or restrict customer access to export functionality through configuration (may not be enforceable if customers have panel access). Each workaround has significant operational trade-offs; vendor patch is the only complete solution.