CVE-2026-41228

The record

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated customer can set `def_language` to a path traversal payload (e.g., `../../../../../var/customers/webs/customer1/evil`), which is stored in the database. On subsequent requests, `Language::loadLanguage()` constructs a file path using this value and executes it via `require`, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-w59f-67xm-rxx7 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads… Same vulnerability
• CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and… CWE-98
• CVE-2026-15406 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin… CWE-98
• CVE-2026-15667 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin… CWE-98
• CVE-2026-11613 The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all… CWE-98
• CVE-2026-28150 Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. CWE-98
• CVE-2026-66586 Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. CWE-98
• CVE-2026-75963 The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all… CWE-98