CVE-2026-41235: Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Synopsis

An authorization bypass vulnerability in Froxlor 2.3.6 allows an authenticated customer to assign an arbitrary shell (such as /bin/bash) to an FTP user by circumventing server-side enforcement of the configured shell whitelist. The attack is reachable over the network and requires only a low-privilege customer account with shell delegation enabled. In deployments using the default nssextrausers integration, successful exploitation grants real host shell access, enabling full read, write, and availability impact on both the affected and downstream systems. Version 2.3.7 fixes the issue, and a patched-image rebuild at that version is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Froxlor panel over the network to submit the malicious FTP account add or edit request.

• AuthenticationRequired

  Any low-privilege customer account with shell delegation enabled is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim action is needed; the attacker submits the crafted request directly to the server-side handler.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has a qualifying account; no race conditions or special environmental factors apply.

Blast Radius

• Reads files and data accessible to the host shell user created via the attacker-controlled FTP account, including configuration files containing credentials.
• Modifies or deletes files on the host system within the permission scope of the escalated shell user.
• Crashes or degrades host services by consuming resources or corrupting files reachable by the shell user.
• Propagates compromise to systems reachable from the host, given that both the affected system and any networked downstream systems carry high subsidiary confidentiality, integrity, and availability impact per the CVSS v4 vector.