CVE-2026-41228 - Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

Back Back to CVE browser

CRITICAL

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

Published Apr 23, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.75%

Description

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated customer can set `def_language` to a path traversal payload (e.g., `../../../../../var/customers/webs/customer1/evil`), which is stored in the database. On subsequent requests, `Language::loadLanguage()` constructs a file path using this value and executes it via `require`, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

Affected products

Vendor Froxlor Product Froxlor Default
n/a
- Version
  < 2.3.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Froxlor

n/a

Version	Status	Constraints
< 2.3.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-98

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25176
Advisory
https://github.com/advisories/GHSA-w59f-67xm-rxx7
Advisory
https://github.com/froxlor/froxlor/commit/bc5e6dbaa90e6f3573129da640595e8c770e1d0c
x_refsource_MISCPatch
https://github.com/froxlor/froxlor/releases/tag/2.3.6
x_refsource_MISCRelease Notes
https://github.com/froxlor/froxlor/security/advisories/GHSA-w59f-67xm-rxx7
exploitx_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41228

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25176		Advisory
https://github.com/advisories/GHSA-w59f-67xm-rxx7		Advisory
https://github.com/froxlor/froxlor/commit/bc5e6dbaa90e6f3573129da640595e8c770e1d0c		x_refsource_MISCPatch
https://github.com/froxlor/froxlor/releases/tag/2.3.6		x_refsource_MISCRelease Notes
https://github.com/froxlor/froxlor/security/advisories/GHSA-w59f-67xm-rxx7		exploitx_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41228