CVE-2026-41229

Katalog CVE

CVSS 9.1 · Critical EPSS 0,69%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada froxlor. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the API, the `privileged_user` parameter (which has no input validation) is written unescaped into `lib/userdata.inc.php`. Since this file is `require`d on every request via `Database::getDB()`, an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-rjv8 exploit · mitigasi · advisory vendor
• https://github.com/froxlor/froxlor/commit/3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae patch
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 release notes