CVE-2026-41236: Froxlor 2.3.6 Symlink Privilege Escalation to Root

Technical summary

CVE-2026-41236 is a classic symlink-following vulnerability (CWE-59) in Froxlor's SSH key synchronization routine. The root-owned cron task that provisions SSH keys for customer FTP users appends public keys to ~/.ssh/authorized_keys without validating that the target path is not a symbolic link. An authenticated attacker with shell access and home directory write permissions can replace ~/.ssh/authorized_keys with a symlink pointing to /root/.ssh/authorized_keys. When the privileged synchronization task runs, it unwittingly appends the attacker's SSH public key directly into root's authorized_keys file, enabling SSH login as root. The flaw stems from insufficient path validation before file operations in a privileged context.

Business impact

Successful exploitation results in complete system compromise via unauthenticated root SSH access following initial account compromise. Attackers can extract sensitive hosting data, modify customer configurations, access other hosted environments, or pivot to additional infrastructure. For hosting providers running Froxlor, this vulnerability affects multi-tenant isolation and customer data security. Even though exploitation requires a shell-enabled customer account—a less common configuration in modern hosting—the impact is critical because it turns a customer account breach into direct infrastructure control. This is particularly severe in environments serving business customers who may have compliance obligations.

Affected systems

Froxlor version 2.3.6 is affected. Version 2.3.7 contains the patch. Vulnerability impact is limited to installations where customer accounts have shell access enabled, as the attack requires the ability to execute commands and modify files in the customer home directory. Hosting providers and system administrators running Froxlor for multi-tenant server administration should audit their deployments immediately.

Exploitability

Exploitability is moderate to high in vulnerable configurations. The attack requires two conditions: (1) an attacker must first compromise or gain access to a shell-enabled customer account, and (2) they must have write access to their home directory—typical in standard Linux configurations. The actual symlink replacement and key injection requires no special privileges or timing precision; the attack succeeds reliably when the cron task next runs. The CVSS score of 8.8 reflects the requirement for prior authentication (lowering from critical) but recognizes the severe impact of resultant root access. This is not a wormable or massively exploitable vulnerability in the wild, but represents a high-value target for attackers already inside a compromised hosting infrastructure.

Remediation

Upgrade Froxlor to version 2.3.7 or later. The patch implements proper symlink detection and path validation before writing to SSH key files in privileged contexts. Additionally, organizations should review whether shell access is necessary for all customer accounts; disabling shell access for FTP-only users substantially reduces attack surface. Audit logs and file system monitoring can detect symlink creation attempts in customer home directories as a compensating control pending patching.

Patch guidance

Apply Froxlor version 2.3.7 as soon as feasible. Verify the patch is installed by checking the Froxlor version number in the administrative interface or via the package manager on the host. Test the update in a non-production environment first to ensure compatibility with your hosting configuration. Because the vulnerability affects SSH key provisioning, monitor SSH access logs for anomalous root login attempts during and after the patching window to confirm the issue is resolved.

Detection guidance

Look for unexpected symbolic links in customer home directories, particularly ~/.ssh/authorized_keys pointing to system paths. Monitor cron job execution logs for any errors or warnings during SSH key synchronization. Audit /root/.ssh/authorized_keys for unexpected or recently added keys, particularly any added around the time a customer account was created or modified. Network intrusion detection should flag unusual SSH root login attempts from internal customer-owned addresses. File integrity monitoring on sensitive SSH configuration files can alert to unauthorized modifications.

Why prioritize this

This vulnerability merits urgent attention because it enables trivial privilege escalation from customer to root once a customer account is compromised. For hosting providers, this is a critical infrastructure risk; for self-hosted Froxlor installations serving multiple users, this undermines the entire multi-user isolation model. While not currently in the CISA KEV catalog, the combination of high CVSS (8.8), clear attack chain, and ease of exploitation in vulnerable configurations makes this a priority for patching. Organizations with shell-enabled customer accounts should patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Network-accessible attack vector (cron task runs as root, reachable via FTP/shell), low attack complexity (no special conditions beyond symlink replacement), requirement for low privilege (customer account), no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact (root compromise). The score appropriately captures the severity of the impact while acknowledging that initial account compromise is a prerequisite; this is not a zero-click or unauthenticated remote code execution.

Frequently asked questions