CVE-2026-41229: Froxlor Server Administration RCE Vulnerability

CVE-2026-41229 Overview

CVE-2026-41229 is a critical code injection vulnerability in Froxlor, an open source server administration software. Prior to version 2.3.6, the PhpHelper::parseArrayToString() function writes string values into single-quoted PHP string literals without properly escaping single quotes. When an administrator with change_serversettings permission adds or updates a MySQL server via the API, the privileged_user parameter—which lacks input validation—is written unescaped into lib/userdata.inc.php. Because this configuration file is included on every request through Database::getDB(), an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load.

Critical Impact

Successful exploitation enables arbitrary PHP code execution on the web server, allowing attackers to achieve full server compromise, data exfiltration, lateral movement, and persistent backdoor installation through a single malicious API request.

Affected Products

• Froxlor Server Administration Software prior to version 2.3.6
• Installations with administrators having change_serversettings permission
• Web servers running Froxlor with API access enabled

Discovery Timeline

• April 23, 2026 - CVE CVE-2026-41229 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41229

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code, or Code Injection). The flaw exists in Froxlor's PHP helper utilities that handle configuration file generation. When MySQL server settings are modified through the administrative API, user-supplied values are written directly into executable PHP code without adequate sanitization.

The PhpHelper::parseArrayToString() function constructs PHP configuration arrays by interpolating user input into single-quoted string literals. However, the function fails to escape single quote characters within the input values. This oversight allows an attacker with sufficient privileges to craft a payload containing a single quote followed by arbitrary PHP code, which will be written into the lib/userdata.inc.php configuration file.

Since this configuration file is loaded on every page request via Database::getDB(), any injected code executes automatically with each HTTP request to the Froxlor installation. This creates a persistent compromise that survives server restarts and continues executing until the malicious code is manually removed.

Root Cause

The root cause is the absence of proper output encoding when writing user-controlled data into PHP string literals. The privileged_user parameter in the MySQL server configuration API endpoint accepts arbitrary input without validation or sanitization. When this input is passed to PhpHelper::parseArrayToString(), single quotes are not escaped, breaking out of the string context and enabling code injection.

The vulnerable code path involves:

1. An authenticated admin submitting MySQL server configuration via API
2. The privileged_user parameter being processed without input validation
3. PhpHelper::parseArrayToString() writing the value without escaping single quotes
4. The malicious payload being persisted to lib/userdata.inc.php
5. Every subsequent page load executing the injected code via require statement

Attack Vector

The attack requires network access and high privileges (administrator with change_serversettings permission). An attacker exploits this vulnerability by submitting a specially crafted privileged_user value through the MySQL server configuration API endpoint. The payload would contain a single quote to escape the string context, followed by arbitrary PHP code.

For example, a malicious privileged_user value could break out of the string literal and inject system commands. The injected code would then execute with the privileges of the web server user (typically www-data or apache) on every page load, enabling remote code execution, file system access, database manipulation, and further exploitation of the hosting infrastructure.

For detailed technical analysis, refer to the GitHub Security Advisory GHSA-gc9w-cc93-rjv8.

Detection Methods for CVE-2026-41229

Indicators of Compromise

• Unexpected modifications to the lib/userdata.inc.php file, particularly entries containing single quotes or PHP function calls in configuration values
• Suspicious API requests to MySQL server configuration endpoints with unusual privileged_user values
• Web server process executing unexpected commands or spawning child processes
• Anomalous network connections originating from the web server user context
• Log entries showing MySQL server configuration changes by admin accounts

Detection Strategies

• Implement file integrity monitoring for lib/userdata.inc.php and other critical Froxlor configuration files
• Audit API access logs for MySQL server configuration endpoints and review parameter values for injection patterns
• Monitor web server processes for unusual child process execution or network activity
• Review admin account activity logs for unauthorized or suspicious configuration changes
• Deploy web application firewall rules to detect code injection patterns in API requests

Monitoring Recommendations

• Enable detailed logging for all administrative API operations in Froxlor
• Configure real-time alerts for any modifications to PHP configuration files in the Froxlor installation directory
• Monitor for outbound connections from web server processes to unexpected destinations
• Implement behavioral analysis for the web server user to detect anomalous command execution

How to Mitigate CVE-2026-41229

Immediate Actions Required

• Upgrade Froxlor to version 2.3.6 or later immediately to apply the security patch
• Review the contents of lib/userdata.inc.php for any suspicious entries or injected PHP code
• Audit administrative accounts with change_serversettings permission and verify their legitimacy
• Check API access logs for any suspicious MySQL server configuration changes
• If compromise is suspected, rotate all database credentials and administrative passwords

Patch Information

Froxlor version 2.3.6 contains the official patch for this vulnerability. The fix implements proper escaping of single quotes when writing values into PHP string literals, preventing the code injection attack vector.

The security fix can be reviewed in the GitHub Commit Update. The patched release is available from GitHub Release Version 2.3.6.

Workarounds

• Restrict change_serversettings permission to only essential administrator accounts until the patch can be applied
• Implement strict network-level access controls to the Froxlor API endpoints
• Enable file integrity monitoring on lib/userdata.inc.php to detect unauthorized modifications
• Consider disabling API access temporarily if MySQL server configuration changes are not required

# Verify Froxlor version and check configuration file integrity
cat /var/www/froxlor/lib/version.php | grep VERSION
sha256sum /var/www/froxlor/lib/userdata.inc.php

# Review recent modifications to the configuration file
ls -la /var/www/froxlor/lib/userdata.inc.php
stat /var/www/froxlor/lib/userdata.inc.php

# Set restrictive permissions on configuration file
chmod 640 /var/www/froxlor/lib/userdata.inc.php
chown root:www-data /var/www/froxlor/lib/userdata.inc.php