Froxlor up to 2.3.5 Destination DataDump.add fixed_homedir link following

Summaryinfo

A vulnerability described as critical has been identified in Froxlor up to 2.3.5. This vulnerability affects the function DataDump.add of the component Destination Handler. Executing a manipulation of the argument fixed_homedir can lead to link following. This vulnerability appears as CVE-2026-41231. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Froxlor up to 2.3.5. It has been declared as critical. This vulnerability affects the function DataDump.add of the component Destination Handler. The manipulation of the argument fixed_homedir with an unknown input leads to a link following vulnerability. The CWE definition for the vulnerability is CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes `chown -R` on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.

The advisory is available at github.com. This vulnerability was named CVE-2026-41231 since 04/18/2026. The exploitation appears to be difficult. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 2.3.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2987b0e8806ef12b532410050ad76d13d673a87d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25182). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion