CVE-2026-41235 Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
Authenticated customers can bypass shell restrictions to gain host shell access if shell delegation is enabled and nssextrausers is used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41235?
CVE-2026-41235 is a high-severity missing authorization vulnerability in froxlor, published on 4 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.
Weakness: CWE-863
Which versions are affected by CVE-2026-41235?
2 open source packages ship an affected version, including froxlor/froxlor.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | From 2.3.6 | 2.3.7 |
froxlor/froxlor Packagist | From 2.3.6 | 2.3.7 |
How do I fix CVE-2026-41235?
Upgrade froxlor/froxlor to 2.3.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41235 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41235 exists.
Sources
Also known as GHSA-gcv3-5v9q-fmhh.