CVE-2026-41231: Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron
Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add() constructs the export destination path from user-supplied input without passing the $fixedhomedir parameter to FileDir::makeCorrectDir(), bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes chown -R on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41231?
CVE-2026-41231 is considered a critical vulnerability due to its potential for arbitrary directory ownership takeover.
How do I fix CVE-2026-41231?
To fix CVE-2026-41231, upgrade to Froxlor version 2.3.6 or later.
What software is affected by CVE-2026-41231?
CVE-2026-41231 affects Froxlor versions prior to 2.3.6.
What kind of attack vector does CVE-2026-41231 exploit?
CVE-2026-41231 exploits incomplete symlink validation in the DataDump.add() method.
Can I find a patch for CVE-2026-41231?
Yes, the patch for CVE-2026-41231 is included in Froxlor version 2.3.6 and later releases.