---
title: "CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)"
url: https://erroneo.us/security/cve/CVE-2026-41229/
description: "CVE-2026-41229 (froxlor/froxlor (Composer (PHP))): Froxlor is open source server administration software. Prior to version 2.3.6…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-04-23
date_modified: 2026-04-24
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-41229"
kev: false
cvss: 9.1
epss: 0.00692
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-41229: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.7% , percentile 52: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 52% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes froxlor/froxlor (Composer (PHP)) <= 2.3.5, fixed in 2.3.6 . Check your lockfile, including transitive dependencies.

## What it is

Froxlor is open source server administration software. Prior to version 2.3.6, PhpHelper::parseArrayToString() writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with changeserversettings permission adds or updates a MySQL server via the API, the privilegeduser parameter (which has no input validation) is written unescaped into lib/userdata.inc.php. Since this file is required on every request via Database::getDB(), an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.

## Affected packages

- Composer (PHP) `froxlor/froxlor` <= 2.3.5 → fixed: 2.3.6

## Affected products (CVE record)

- froxlor froxlor: < 2.3.6

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.69% probability of exploitation activity in the next 30 days; percentile 52.

## Sources

- [GitHub Advisory GHSA-gc9w-cc93-rjv8](https://github.com/advisories/GHSA-gc9w-cc93-rjv8)
- [CVE.org record CVE-2026-41229](https://www.cve.org/CVERecord?id=CVE-2026-41229)
- [NVD entry CVE-2026-41229](https://nvd.nist.gov/vuln/detail/CVE-2026-41229)
- [github.com](https://github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-rjv8)
- [github.com](https://github.com/froxlor/froxlor/commit/3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae)
- [github.com](https://github.com/froxlor/froxlor/releases/tag/2.3.6)

---
Source page: https://erroneo.us/security/cve/CVE-2026-41229/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt