CVE-2026-41236
HighCVSS 8.8Summary
Froxlor is server administration software that in version 2.3.6 contains a symlink-following flaw in the SSH key synchronization path, potentially allowing an attacker to gain root access.
Risk Assessment
An attacker controlling a customer account can gain root access, posing a serious security risk to the system.
Recommendation
It is recommended to upgrade to version 2.3.7, which includes a patch addressing this vulnerability.
Original NVD description (English source)
Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.