CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
Froxlor is open source server administration software. Prior to version 2.3.6, PhpHelper::parseArrayToString() writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with changeserversettings permission adds or updates a MySQL server via the API, the privilegeduser parameter (which has no input validation) is written unescaped into lib/userdata.inc.php. Since this file is required on every request via Database::getDB(), an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41229?
CVE-2026-41229 has a medium severity level due to its potential for PHP code injection under certain conditions.
How do I fix CVE-2026-41229?
To fix CVE-2026-41229, upgrade to Froxlor version 2.3.6 or later, which ensures proper escaping of single quotes.
What versions of Froxlor are affected by CVE-2026-41229?
Froxlor versions prior to 2.3.6 are affected by CVE-2026-41229.
What type of vulnerability is CVE-2026-41229?
CVE-2026-41229 is classified as a PHP code injection vulnerability.
What is the impact of CVE-2026-41229 on users?
The impact of CVE-2026-41229 can allow attackers to execute arbitrary PHP code, potentially compromising server security.