PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41236 froxlor CVE debrief

CVE-2026-41236 is a HIGH-severity vulnerability in Froxlor server administration software. Version 2.3.6 of Froxlor contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. An attacker controlling a shell-enabled customer account can modify files inside the assigned home directory, replacing `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. The vulnerability was patched in version 2.3.7.

Vendor
froxlor
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Administrators using Froxlor server administration software version 2.3.6 should upgrade to version 2.3.7 to mitigate this vulnerability.

Technical summary

The vulnerability has a CVSS score of 8.8 and is classified as CWE-59. The attack vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Froxlor to version 2.3.7 or later.
  • Review and restrict access to customer-controlled home directories.
  • Monitor SSH key synchronization and cron task logs for suspicious activity.

Evidence notes

The CVE record and NVD detail can be found at [cve-org] and [nvd], respectively. Additional information is available at [ref-4] and [ref-5].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41236 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41236

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41236 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41236

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.