CVE-2026-41228: Froxlor Path Traversal Vulnerability

CVE-2026-41228 Overview

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint Customers.update (and Admins.update) does not validate the def_language parameter against the list of available language files. An authenticated customer can set def_language to a path traversal payload (e.g., ../../../../../var/customers/webs/customer1/evil), which is stored in the database. On subsequent requests, Language::loadLanguage() constructs a file path using this value and executes it via require, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

Critical Impact

This vulnerability allows authenticated users to achieve arbitrary PHP code execution on the server by exploiting a path traversal flaw in the language file loading mechanism, potentially leading to complete server compromise.

Affected Products

• Froxlor versions prior to 2.3.6

Discovery Timeline

• 2026-04-23 - CVE CVE-2026-41228 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-41228

Vulnerability Analysis

This vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote File Inclusion. The flaw exists in the Froxlor API endpoints responsible for updating customer and administrator profiles.

The vulnerable code path allows authenticated users to manipulate the def_language parameter without proper validation. When a user sets their preferred language through the Customers.update or Admins.update API endpoints, the application stores this value directly in the database without checking if it corresponds to a legitimate language file.

The exploitation chain works as follows: an attacker first uploads a malicious PHP file to a location accessible by the web server (such as a customer's web directory). They then update their profile's def_language parameter to a path traversal payload pointing to this malicious file. On subsequent authenticated requests, the Language::loadLanguage() function constructs a file path using the stored value and includes it via PHP's require statement, executing the attacker's code with web server privileges.

Root Cause

The root cause is insufficient input validation in the Customers.update and Admins.update API commands. The def_language parameter is not validated against the list of available language files before being stored in the database. Combined with the use of PHP's require statement for loading language files, this creates a Local File Inclusion (LFI) vulnerability that can be escalated to Remote Code Execution (RCE).

Attack Vector

The attack requires authenticated access to Froxlor with at least customer-level privileges. The attacker exploits the network-accessible API endpoint by:

1. Uploading a malicious PHP file to a known location on the server
2. Sending a crafted request to the Customers.update or Admins.update endpoint with a path traversal payload in the def_language parameter
3. Triggering the Language::loadLanguage() function on subsequent requests to execute the malicious code

The security patch adds proper validation by importing the Language class and checking the def_language parameter against existing language files:

use Froxlor\Database\Database;
use Froxlor\FroxlorLogger;
use Froxlor\Idna\IdnaWrapper;
+use Froxlor\Language;
use Froxlor\Settings;
use Froxlor\System\Crypt;
use Froxlor\UI\Response;

Source: GitHub Commit Details

Detection Methods for CVE-2026-41228

Indicators of Compromise

• Unusual values in the def_language database field containing path traversal sequences such as ../ or absolute paths
• PHP files appearing in customer web directories that were not legitimately uploaded
• Web server logs showing requests to Froxlor API endpoints with suspicious def_language parameter values
• Unexpected processes or network connections originating from the web server user account

Detection Strategies

• Monitor Froxlor API logs for Customers.update and Admins.update requests containing path traversal patterns in the def_language parameter
• Implement file integrity monitoring on Froxlor installation directories to detect unauthorized modifications
• Review database records for the def_language field to identify values that do not match expected language file names (e.g., en, de, fr)
• Deploy web application firewall (WAF) rules to detect and block path traversal patterns in API requests

Monitoring Recommendations

• Enable detailed logging for Froxlor API endpoints and forward logs to a SIEM solution for analysis
• Set up alerts for any database modifications to user language preferences that contain special characters or path separators
• Monitor web server process execution for unexpected child processes or outbound network connections
• Regularly audit customer upload directories for suspicious PHP files

How to Mitigate CVE-2026-41228

Immediate Actions Required

• Upgrade Froxlor to version 2.3.6 or later immediately
• Audit the database for any def_language values containing path traversal sequences and reset them to valid language codes
• Review server logs for any evidence of exploitation attempts or successful code execution
• If compromise is suspected, perform a full incident response including credential rotation and malware scanning

Patch Information

The vulnerability has been fixed in Froxlor version 2.3.6. The patch validates the def_language parameter against the list of available language files before storing it in the database, preventing path traversal attacks. The security fix can be reviewed in the GitHub Commit Details and the release is available at GitHub Release Tag 2.3.6. For additional details, see the GitHub Security Advisory GHSA-w59f-67xm-rxx7.

Workarounds

• Restrict access to Froxlor API endpoints at the network level using firewall rules or reverse proxy configurations
• Implement additional authentication requirements for API access if possible
• Disable customer self-service profile editing if not required for operations
• Monitor and restrict file upload capabilities within customer web directories

# Database audit query to identify potentially malicious def_language values
mysql -e "SELECT loginname, def_language FROM panel_customers WHERE def_language LIKE '%..%' OR def_language LIKE '%/%';" froxlor