CVE-2026-41236: Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Synopsis

A symlink-following privilege escalation affects Froxlor version 2.3.6, specifically in the root-owned SSH key synchronization routine for customer FTP users. The flaw is reachable over the network by any low-privilege authenticated customer account, with no additional interaction required from an administrator or other victim. Successful exploitation gives the attacker root SSH access to the host server. A patched-image rebuild at version 2.3.7 is available on HarborGuard for environments running the affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Froxlor service over the network to authenticate and manipulate files in the assigned home directory; AV:N confirms this is a remotely exploitable path.

• AuthenticationRequired

  A low-privilege customer account with shell access is sufficient; no administrative credentials are needed (PR:L).

• Victim interactionNot required

  No administrator or other user needs to take any action; the privileged cron task runs automatically and triggers the key write without any victim involvement (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker has placed the symlink; no race conditions or special memory layout requirements apply (AC:L).

Blast Radius

• The attacker's supplied SSH public key is written into /root/.ssh/authorized_keys, granting direct root SSH login to the host server.
• With root access, the attacker reads all data on the host, including credentials, private keys, and customer data stored on the server.
• With root access, the attacker modifies or deletes any file on the system, including Froxlor configuration, hosted web content, and database files.
• The attacker can crash, reconfigure, or fully take over any service running on the host, including web, mail, and database processes managed by Froxlor.