Is CVE-2026-41236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41236 being exploited in the wild.

How severe is CVE-2026-41236?

High severity, with a CVSS score of 8.8, published 4 June 2026.

Which products and versions are affected?

Froxlor 2.3.6; froxlor/froxlor (Packagist) = 2.3.6, ECOSYSTEM:introduced=2.3.6,fixed=2.3.7.

Is there a fix for CVE-2026-41236?

Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41236 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41236?

Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41236: Froxlor privilege escalation via symlink following in SSH key sync

CVE-2026-41236 · Severity: high · CVSS 8.8 · Published 2026-06-04

Froxlor is an open-source server management platform used to administer web hosting environments. A security flaw in how the system synchronizes SSH keys allows a customer with basic account access to trick the system into granting them full administrative (root) control over the entire server. This could lead to total data exposure, service disruption, and unauthorized access to all other customer accounts on the same machine.

Technologies: Froxlor, froxlor/froxlor (Packagist). Vendors: Froxlor, Packagist.

Quick answers

Is CVE-2026-41236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41236 being exploited in the wild.
How severe is CVE-2026-41236?: High severity, with a CVSS score of 8.8, published 4 June 2026.
Which products and versions are affected?: Froxlor 2.3.6; froxlor/froxlor (Packagist) = 2.3.6, ECOSYSTEM:introduced=2.3.6,fixed=2.3.7.
Is there a fix for CVE-2026-41236?: Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41236 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41236?: Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

froxlor/froxlor (Packagist): upgrade to 2.3.7 or later
```
composer require froxlor/froxlor:^2.3.7
```

Technical details

A symlink-following vulnerability (CWE-59) exists in Froxlor 2.3.6 within the root-owned SSH key synchronization logic. The application appends public keys to `~/.ssh/authorized_keys` in customer-controlled home directories without verifying if the path is a symbolic link. An authenticated attacker with shell-enabled customer access can replace their `authorized_keys` file with a symlink pointing to `/root/.ssh/authorized_keys`. When the privileged cron task runs the `REBUILD_NSSUSERS` task, it follows the link and appends the attacker's public key to the root user's authorized keys file, granting the attacker full root SSH access. This issue is resolved in version 2.3.7.

Affected products

Froxlor Froxlor 2.3.6

Identifiers

CVE-2026-41236
GHSA-mq5v-pxpm-8jw2

Timeline

2026-05-15: patched: Version 2.3.7 released
2026-05-29: advisory: GitHub Security Advisory published
2026-06-04: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.