8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41236

CVE-2026-41236: Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to ~/.ssh/authorized_keys under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace ~/.ssh/authorized_keys with a symlink to /root/.ssh/authorized_keys. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41236

CVE-2026-41236:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
froxlor/froxlor	composer	= 2.3.6	2.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic symlink-following (or 'link following') issue, categorized as CWE-59. It allows a low-privileged user to escalate their privileges to root. The vulnerability exists in the process that synchronizes SSH public keys for FTP users, which is executed by a cron job with root privileges.

The core of the issue lies in the Froxlor\FileDir::makeCorrectFile function. This function was used to construct the path to the authorized_keys file but did not check if any component of the path was a symbolic link. An attacker with shell access to their home directory could replace their ~/.ssh/authorized_keys file with a symbolic link pointing to /root/.ssh/authorized_keys.

The Froxlor\Cron\System\SshKeys::generateFiles function, running as root, would then call makeCorrectFile to get the path for writing the user's submitted public key. Since makeCorrectFile didn't resolve the symlink, generateFiles would unknowingly append the attacker's public key to the root user's authorized_keys file.

The patch addresses this by modifying Froxlor\FileDir::makeCorrectFile to perform rigorous symlink checking. It now traverses the path and uses is_link() and readlink() to ensure that the final path is within the user's legitimate home directory, throwing an exception if a symlink points outside of it. The Froxlor\Cron\System\SshKeys::generateFiles function was also updated to supply the user's home directory to makeCorrectFile for this validation to occur.

Vulnerable functions

Froxlor\Cron\System\SshKeys::generateFiles

lib/Froxlor/Cron/System/SshKeys.php

This function is responsible for generating the `authorized_keys` file for users. When executed by the root-owned cron job, it would write to a file path constructed from user-controllable data (`homedir`). Before the patch, it did not validate whether the path was a symbolic link, allowing an attacker to create a symlink from `~/.ssh/authorized_keys` to a privileged location like `/root/.ssh/authorized_keys`. When the cron job ran, it would append the attacker's public key to the root user's `authorized_keys` file, leading to root access.

Froxlor\FileDir::makeCorrectFile

lib/Froxlor/FileDir.php

This function is the root cause of the vulnerability. It was used to construct file paths but lacked any validation to prevent the use of symbolic links. An attacker could create a symlink in their home directory pointing to a sensitive system file. Because this function did not resolve or validate the final path, other parts of the application that used it, like `SshKeys::generateFiles`, could be tricked into writing to arbitrary files on the system with the privileges of the executing process (in this case, root).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.