CVE-2026-41229

CVE-2026-41229 is a critical code injection vulnerability in Froxlor open source server administration software prior to version 2.3.6. The flaw exists in the PhpHelper::parseArrayToString() function, which fails to escape single quotes when writing the privileged_user parameter to a PHP configuration file during MySQL server management operations via the API. This allows an authenticated administrator with change_serversettings permissions to inject arbitrary PHP code that executes on every page load with web server privileges. The vulnerability carries a CVSS 3.1 severity score of 9.1 (CRITICAL) with a network-based attack vector and low complexity. An attacker requires high privilege level (admin with specific permissions) but no user interaction. The impact is severe, affecting confidentiality, integrity, and availability across the affected system and potentially connected systems. The injected code executes persistently in a core file loaded on every request, providing sustained access. Exploitation status indicates this vulnerability is not currently listed on the KEV catalog and shows no signs of active exploitation in the wild, with minimal community attention reflected in a low EPSS score of 0.0004. However, the FAUCET Risk Score of 52.0/100 suggests moderate concern. Organizations running Froxlor should prioritize updating to version 2.3.6 or later to patch this critical flaw, particularly if the affected system is internet-facing or accessible to untrusted administrators.