CVE-2026-41229 - Vulnerability Analysis

Overview

Froxlor < 2.3.6 contains a code injection vulnerability caused by unescaped single quotes in PhpHelper::parseArrayToString() when writing the privileged_user parameter in lib/userdata.inc.php, letting attackers with change_serversettings permission execute arbitrary PHP code as the web server user, exploit requires admin privileges.

Severity & Score

Impact

Attackers with admin privileges can execute arbitrary PHP code as the web server user, leading to full server compromise.

Mitigation

Update to version 2.3.6 or later.

References

• https://github.com/froxlor/froxlor/releases/tag/2.3.6
• https://github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-rjv8
• https://github.com/froxlor/froxlor/commit/3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 23, 2026

🔴 CVE-2026-41229 - Critical (9.1) Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings`... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41229/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner