What is the CVSS score of EUVD-2026-25178?

EUVD-2026-25178 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Froxlor are affected by EUVD-2026-25178?

Froxlor server administration software versions before 2.3.6 contain a critical remote code execution vulnerability that allows authenticated administrators to inject malicious PHP code through…. A patch is available.

How to fix or mitigate EUVD-2026-25178?

Within 24 hours: Identify all Froxlor installations and document current versions using administrative inventory tools. Within 7 days: Upgrade all Froxlor instances to version 2.3.6 or later; test in non-production environment first. Within 30 days: Audit administrative access logs for suspicious configuration changes, review user privileges to restrict change_serversettings permission to essential personnel only, and implement Web Application Firewall rules to detect PHP injection patterns in server configuration parameters.

Froxlor EUVD-2026-25178

| CVE-2026-41229 CRITICAL

Code Injection (CWE-94)

2026-04-23 GitHub_M

GHSA-gc9w-cc93-rjv8

PHP Code Injection RCE

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 27, 2026 - 17:00 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 13:22 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:44 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 04:00 euvd

EUVD-2026-25178

Analysis Generated

Apr 23, 2026 - 04:00 vuln.today

CVE Published

Apr 23, 2026 - 03:44 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Froxlor is open source server administration software. Prior to version 2.3.6, PhpHelper::parseArrayToString() writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with change_serversettings permission adds or updates a MySQL server via the API, the privileged_user parameter (which has no input validation) is written unescaped into lib/userdata.inc.php. Since this file is required on every request via Database::getDB(), an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.

AnalysisAI

Remote code execution in Froxlor server administration software versions prior to 2.3.6 allows authenticated administrators with change_serversettings permission to inject arbitrary PHP code through an unescaped MySQL server configuration parameter. The vulnerability enables persistent code execution on every subsequent HTTP request as the web server user due to improper input sanitization in PhpHelper::parseArrayToString(). Vendor patch available in version 2.3.6. CVSS score of 9.1 reflects the critical impact despite requiring high-privilege authentication, with scope change indicating the attacker can break out of the application's security context.

Technical ContextAI

Froxlor is an open-source server administration panel written in PHP for managing web hosting environments. The vulnerability exists in the PhpHelper::parseArrayToString() function which generates PHP code for configuration files. When processing MySQL server settings via the API endpoint, the function writes the privileged_user parameter value into single-quoted PHP string literals in lib/userdata.inc.php without escaping single quote characters. This configuration file is required on every request through the Database::getDB() initialization path, making any injected code persistent and executed on all subsequent page loads. The root cause is CWE-94 (Improper Control of Generation of Code - Code Injection), specifically a failure to neutralize special characters in data used to construct executable PHP code. The affected product CPE is cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*, with all versions before 2.3.6 vulnerable.

RemediationAI

Upgrade to Froxlor version 2.3.6 immediately, available at https://github.com/froxlor/froxlor/releases/tag/2.3.6. The fix implemented in commit 3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae adds proper single-quote escaping in PhpHelper::parseArrayToString(). For environments where immediate patching is not possible, implement compensating controls: restrict change_serversettings permission to only fully trusted administrator accounts, audit lib/userdata.inc.php for suspicious PHP code patterns, monitor admin API access logs for MySQL server configuration changes, and consider deploying web application firewall rules to inspect API requests to MySQL server management endpoints for code injection patterns (note this provides detection not prevention since the API may legitimately contain special characters). After upgrading, regenerate lib/userdata.inc.php by re-saving MySQL server settings to ensure no malicious code persists from prior exploitation. Review web server access logs and application logs for unusual admin activity during the vulnerable period.