CVE-2026-41236 Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
An attacker with a shell-enabled customer account can symlink authorized_keys to root's file, gaining root SSH access via Froxlor's key synchronization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41236?
CVE-2026-41236 is a high-severity path traversal vulnerability in froxlor, published on 4 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.
Weakness: CWE-59
Which versions are affected by CVE-2026-41236?
2 open source packages ship an affected version, including froxlor/froxlor.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | From 2.3.6 | 2.3.7 |
froxlor/froxlor Packagist | From 2.3.6 | 2.3.7 |
How do I fix CVE-2026-41236?
Upgrade froxlor/froxlor to 2.3.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-41236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41236 exists.
Sources
Also known as GHSA-mq5v-pxpm-8jw2.