CVE-2026-41236

HighUpdated

Published: 04 June 2026

Published

04 June 2026

Modified

17 June 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0037 28.6th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41236 is a high-severity Link Following (CWE-59) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

No EU or UK CSIRT advisories indexed for this CVE.

Vulnerability details

Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying…

that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.

CWE(s): CWE-59

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1098.004 SSH Authorized Keys Persistence

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host.

attack.mitre.org →

Why these techniques?

Symlink flaw in privileged SSH key sync directly enables root account manipulation via authorized_keys (T1098.004) and local privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0