PHP file inclusion in Froxlor - CVE-2026-41228
Published: April 27, 2026
Vulnerability identifier: #VU128200
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-41228
CWE-ID: CWE-98
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: froxlor
Affected software:
Froxlor
Froxlor
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of filename for include/require statement in PHP program in the Customers.update and Admins.update API endpoints and Language::loadLanguage() when processing the def_language parameter. A remote user can set def_language to a path traversal payload that references an attacker-controlled .lng.php file to execute arbitrary code.
Exploitation requires valid customer or admin API access and relies on a subsequent API request or fresh web login loading the stored def_language value.
How to mitigate CVE-2026-41228
Install security update from vendor's website.