Arbitrary Shell Command Execution in Froxlor Server Administration Software

CVE-2026-41235

What is CVE-2026-41235?

Froxlor, an open source server administration software, allows an authenticated user to bypass restrictions on shell assignment for FTP accounts. In version 2.3.6, the system.available_shells configuration setting is intended to limit available shells; however, this limitation is not enforced during the add or edit requests processed by the server-side FTP account handlers. Consequently, an authenticated customer, who has shell delegation enabled, can exploit this flaw to assign an arbitrary shell (e.g., /bin/bash) contrary to the options displayed in the user interface. This results in the unauthorized propagation of a malicious shell into the system account database, potentially providing the attacker with unrestricted host shell access. The issue has been resolved in version 2.3.7.

References