CVE-2026-41236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41236", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-18T03:47:03.134Z", "datePublished": "2026-06-04T17:52:10.066Z", "dateUpdated": "2026-06-08T14:32:22.356Z"}, "containers": {"cna": {"title": "Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2"}, {"name": "https://github.com/froxlor/froxlor/releases/tag/2.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/froxlor/froxlor/releases/tag/2.3.7"}], "affected": [{"vendor": "froxlor", "product": "froxlor", "versions": [{"version": "= 2.3.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T17:52:10.066Z"}, "descriptions": [{"lang": "en", "value": "Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch."}], "source": {"advisory": "GHSA-mq5v-pxpm-8jw2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T14:31:23.498499Z", "id": "CVE-2026-41236", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T14:32:22.356Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41236", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T14:31:23.498499Z"}}}], "references": [{"url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T14:31:51.182Z"}}], "cna": {"title": "Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path", "source": {"advisory": "GHSA-mq5v-pxpm-8jw2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "froxlor", "product": "froxlor", "versions": [{"status": "affected", "version": "= 2.3.6"}]}], "references": [{"url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "name": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/froxlor/froxlor/releases/tag/2.3.7", "name": "https://github.com/froxlor/froxlor/releases/tag/2.3.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T17:52:10.066Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41236", "state": "PUBLISHED", "dateUpdated": "2026-06-08T14:32:22.356Z", "dateReserved": "2026-04-18T03:47:03.134Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-04T17:52:10.066Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "froxlor", "vendor": "froxlor", "versions": [{"status": "affected", "version": "= 2.3.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch."}, {"lang": "es", "value": "Froxlor es un software de administraci\u00f3n de servidores de c\u00f3digo abierto. La versi\u00f3n 2.3.6 contiene una falla de seguimiento de enlaces simb\u00f3licos en la ruta de sincronizaci\u00f3n de claves SSH propiedad de root utilizada para usuarios FTP de clientes. El c\u00f3digo de aprovisionamiento a\u00f1ade claves p\u00fablicas a ~/.ssh/authorized_keys en un directorio de inicio controlado por el cliente sin verificar que la ruta de destino no sea un enlace simb\u00f3lico. Si un atacante controla una cuenta de cliente con acceso a shell y puede modificar archivos dentro del directorio de inicio asignado, el atacante puede reemplazar ~/.ssh/authorized_keys con un enlace simb\u00f3lico a /root/.ssh/authorized_keys. Cuando la tarea cron privilegiada de Froxlor sincroniza posteriormente las claves SSH, a\u00f1ade la clave proporcionada por el atacante al archivo de claves autorizadas de root, lo que resulta en acceso SSH como root. La versi\u00f3n 2.3.7 contiene un parche."}], "id": "CVE-2026-41236", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41236", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T14:31:23.498499Z", "version": "2.0.3"}}]}, "published": "2026-06-04T19:16:29.327", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/froxlor/froxlor/releases/tag/2.3.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mq5v-pxpm-8jw2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.3.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "froxlor", "source": "cna", "vendor": "froxlor"}, "product": "froxlor", "vendor": "froxlor"}], "created": "2026-06-04T20:00:10.688648+00:00", "updated": "2026-06-04T20:30:16.033540+00:00", "vendors": ["froxlor", "froxlor$PRODUCT$froxlor"]}