CVE-2026-41236

Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/froxlor/froxlor/releases/tag/2.3.7
https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2
https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-04 19:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-41236

Mitre link : CVE-2026-41236

CVE.ORG link : CVE-2026-41236

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-41236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41236", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T14:31:23.498499Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "froxlor", "product": "froxlor", "versions": [{"status": "affected", "version": "= 2.3.6"}]}]}], "published": "2026-06-04T19:16:29.327", "references": [{"url": "https://github.com/froxlor/froxlor/releases/tag/2.3.7", "source": "security-advisories@github.com"}, {"url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "source": "security-advisories@github.com"}, {"url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch."}, {"lang": "es", "value": "Froxlor es un software de administraci\u00f3n de servidores de c\u00f3digo abierto. La versi\u00f3n 2.3.6 contiene una falla de seguimiento de enlaces simb\u00f3licos en la ruta de sincronizaci\u00f3n de claves SSH propiedad de root utilizada para usuarios FTP de clientes. El c\u00f3digo de aprovisionamiento a\u00f1ade claves p\u00fablicas a ~/.ssh/authorized_keys en un directorio de inicio controlado por el cliente sin verificar que la ruta de destino no sea un enlace simb\u00f3lico. Si un atacante controla una cuenta de cliente con acceso a shell y puede modificar archivos dentro del directorio de inicio asignado, el atacante puede reemplazar ~/.ssh/authorized_keys con un enlace simb\u00f3lico a /root/.ssh/authorized_keys. Cuando la tarea cron privilegiada de Froxlor sincroniza posteriormente las claves SSH, a\u00f1ade la clave proporcionada por el atacante al archivo de claves autorizadas de root, lo que resulta en acceso SSH como root. La versi\u00f3n 2.3.7 contiene un parche."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "security-advisories@github.com"}