CVE-2026-41231
Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes `chown -R` on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.
- Affected products
- Froxlor
- Froxlor
- < 2.3.6
- Fix
- Available
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 0.4% (34th percentile)
- Weakness
- CWE-59
- NVD status
- Analyzed
- Published
- 2026-04-23
No indexed exploits for CVE-2026-41231 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-41231 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.