Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-41235 Unauthenticated Shell Assignment Bypass in Froxlor 2.3.6 Leading to Host Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41235
Post summary
The text announces CVE-2026-41235, describing an unauthenticated Shell Assignment Bypass in Froxlor 2.3.6 that can lead to host access. No proof‑of‑concept, exploit code, patch information, or evidence of active exploitation is provided.