Unescaped Input Vulnerability in Froxlor Server Administration Software
CVE-2026-41229

9.1CRITICAL

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41229?

Froxlor, an open-source server administration tool, contains a vulnerability that allows for arbitrary PHP code execution through unescaped input in MySQL server settings. An admin with the change_serversettings permission can unintentionally introduce malicious code via the privileged_user parameter, which lacks input validation. As this unvalidated input is written directly into a critical configuration file, it poses security risks on every web request. Version 2.3.6 includes a security patch to mitigate this risk.

Affected Version(s)

froxlor < 2.3.6

References

https://github.com/froxlor/froxlor/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/froxlor/froxlor/commit/3589ddf93ab59eb...
x_refsource_MISC
https://github.com/froxlor/froxlor/releases/tag/2.3.6
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.