CVE-2026-41228

The API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against a list of available language files. An authenticated user can pass a path traversal payload (e.g., `../../../../../var/customers/webs/customer1/evil`) as the value of this parameter, which is then stored in the database. On subsequent requests, the `Language::loadLanguage()` function constructs the file path based on this value and executes it with the `require` instruction, leading to arbitrary PHP code execution as the web server process user.

An attacker can execute arbitrary PHP code on the server with the privileges of the web server user, which in practice means complete takeover of the application, access to customer data, and potential lateral movement in the hosting infrastructure.

Froxlor should be updated to version 2.3.6, which introduces validation of the `def_language` parameter against a list of available language files. The patch is available in the manufacturer's GitHub repository (commit bc5e6dbaa90e6f3573129da640595e8c770e1d0c) and in release 2.3.6.

Froxlor in all versions before 2.3.6