Skip to content
OpenAdvisories
High WID-SEC-2026-1124 6 CVEs

Froxlor: Mehrere Schwachstellen

Published Apr 14, 2026 · Updated Apr 22, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Dateien zu manipulieren.

Product

Froxlor ist eine Web-basierte Server-Management-Software.

Vulnerabilities 6

  • Critical 10.0
    CVE-2026-41228

    Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

    Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated cust…

    froxlor froxlor froxlor/froxlor Packagist
  • Critical 9.1
    CVE-2026-41229

    Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

    Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission …

    froxlor froxlor froxlor/froxlor Packagist
  • High 8.5
    CVE-2026-41230

    Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

    Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/e…

    froxlor froxlor froxlor/froxlor Packagist
  • High 7.5
    CVE-2026-41231

    Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

    Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlin…

    froxlor froxlor froxlor/froxlor Packagist
  • Medium 5.4
    CVE-2026-41233

    Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

    Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used without validation when the calling reseller does not have the `customers_see_all` permission. This…

    froxlor froxlor froxlor/froxlor Packagist
  • Medium 5.0
    CVE-2026-41232

    Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing

    Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead o…

    froxlor froxlor froxlor/froxlor Packagist

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References