CVE-2026-41231

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada froxlor. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes `chown -R` on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/froxlor/froxlor/security/advisories/GHSA-75h4-c557-j89r exploit · mitigasi · advisory vendor
• https://github.com/froxlor/froxlor/commit/2987b0e8806ef12b532410050ad76d13d673a87d patch
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 release notes