CVE-2026-41235: Panel shell whitelist bypass grants

CISO Take

Froxlor 2.3.6 fails to enforce the administrator-configured shell whitelist server-side, allowing any authenticated customer with shell delegation enabled to submit an arbitrary shell (e.g., /bin/bash) that gets materialized as the OS-level login shell by a root-owned provisioning cron. This is directly relevant to teams using Froxlor-managed shared hosting for AI/ML workloads — Jupyter notebooks, Streamlit apps, model APIs, vector databases — where a compromised co-tenant gains the ability to traverse tenant boundaries and access model weights, training datasets, and stored API keys. With CVSS 8.8, 469 downstream dependents, trivial exploitation requiring only a valid customer account, and default installer settings meeting all prerequisites, this warrants immediate action on any Froxlor deployment hosting AI workloads. Patch to Froxlor 2.3.7 immediately, or as an interim workaround disable system.allow_customer_shell in panel settings; audit the ftp_users.shell column for any entries outside your approved shell whitelist.

Sources: NVD GitHub Advisory ATLAS OpenSSF

What is the risk?

HIGH. Exploitation requires only a valid customer account and Froxlor's default installer configuration (nssextrausers=1, allow_customer_shell=1 with per-customer delegation), making this broadly exploitable on shared hosting deployments without any specialized AI or security knowledge. The attacker's shell is materialized at the OS level by a root-owned cron, meaning the foothold survives panel-level remediation that does not also purge the NSS extrausers database. The jump from FTP-restricted tenant to interactive host shell dramatically expands blast radius: lateral movement to co-hosted services, credential harvesting from .env files, and persistent access. Not yet in CISA KEV and no public scanner template, but the PoC is a single crafted POST request — exploitation difficulty is trivial once prerequisites are confirmed.

How does the attack unfold?

Initial Access

Attacker authenticates to Froxlor as a legitimate customer account that has shell delegation enabled (allow_customer_shell=1, shell_allowed=1 on their account).

AML.T0012

Authorization Bypass

Attacker crafts and submits a POST request to customer_ftp.php with shell=/bin/bash, exploiting the missing server-side whitelist validation to store an unauthorized shell value in ftp_users.shell.

AML.T0049

Privilege Escalation

Root-owned Froxlor master cron processes the REBUILD_NSSUSERS task and regenerates /var/lib/extrausers/passwd, materializing /bin/bash as the attacker's OS-level login shell.

AML.T0105

Impact

Attacker gains interactive host shell via SSH, traverses co-tenant directories to exfiltrate AI/ML artifacts (model weights, API keys, training data), and establishes persistence on the server.

AML.T0037

Initial Access

Attacker authenticates to Froxlor as a legitimate customer account that has shell delegation enabled (allow_customer_shell=1, shell_allowed=1 on their account).

AML.T0012

Authorization Bypass

Attacker crafts and submits a POST request to customer_ftp.php with shell=/bin/bash, exploiting the missing server-side whitelist validation to store an unauthorized shell value in ftp_users.shell.

AML.T0049

Privilege Escalation

Root-owned Froxlor master cron processes the REBUILD_NSSUSERS task and regenerates /var/lib/extrausers/passwd, materializing /bin/bash as the attacker's OS-level login shell.

AML.T0105

Impact

Attacker gains interactive host shell via SSH, traverses co-tenant directories to exfiltrate AI/ML artifacts (model weights, API keys, training data), and establishes persistence on the server.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	composer	= 2.3.6	`2.3.7`
5.7K OpenSSF 7.0 492 dependents Pushed 6d ago 63% patched ~16d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

6 steps

Patch to Froxlor 2.3.7 immediately — this release adds server-side whitelist enforcement in Ftps::add() and Ftps::update().
If immediate patching is not possible, disable system.allow_customer_shell in Froxlor Settings → FTP to prevent any customer from setting a shell value. Alternatively, set system.nssextrausers=0 to prevent shell propagation to the OS layer (requires restart of NSS services).
Audit for existing exploitation: run SELECT username, shell FROM ftp_users WHERE shell NOT IN (SELECT trim(unnest(string_to_array(value, ','))) FROM settings WHERE settingname = 'system.available_shells') on the Froxlor PostgreSQL instance.
Inspect /var/lib/extrausers/passwd for unauthorized shell entries (/bin/bash, /bin/sh, etc.) and manually correct any found.
Review SSH and FTP authentication logs for customer accounts that subsequently established interactive shell sessions.
Enforce network-level controls restricting SSH access to known administrator IP ranges, removing SSH as an accessible attack surface for customer accounts.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution API Inference AML.T0012 - Valid Accounts AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - Segregation of duties A.8.2 - Access control

NIST AI RMF

GOVERN 6.2 - Policies and procedures are in place to address AI risks and benefits across the organization

Frequently Asked Questions

What is CVE-2026-41235?

Froxlor 2.3.6 fails to enforce the administrator-configured shell whitelist server-side, allowing any authenticated customer with shell delegation enabled to submit an arbitrary shell (e.g., /bin/bash) that gets materialized as the OS-level login shell by a root-owned provisioning cron. This is directly relevant to teams using Froxlor-managed shared hosting for AI/ML workloads — Jupyter notebooks, Streamlit apps, model APIs, vector databases — where a compromised co-tenant gains the ability to traverse tenant boundaries and access model weights, training datasets, and stored API keys. With CVSS 8.8, 469 downstream dependents, trivial exploitation requiring only a valid customer account, and default installer settings meeting all prerequisites, this warrants immediate action on any Froxlor deployment hosting AI workloads. Patch to Froxlor 2.3.7 immediately, or as an interim workaround disable system.allow_customer_shell in panel settings; audit the ftp_users.shell column for any entries outside your approved shell whitelist.

Is CVE-2026-41235 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-41235, increasing the risk of exploitation.

How to fix CVE-2026-41235?

1. Patch to Froxlor 2.3.7 immediately — this release adds server-side whitelist enforcement in Ftps::add() and Ftps::update(). 2. If immediate patching is not possible, disable system.allow_customer_shell in Froxlor Settings → FTP to prevent any customer from setting a shell value. Alternatively, set system.nssextrausers=0 to prevent shell propagation to the OS layer (requires restart of NSS services). 3. Audit for existing exploitation: run SELECT username, shell FROM ftp_users WHERE shell NOT IN (SELECT trim(unnest(string_to_array(value, ','))) FROM settings WHERE settingname = 'system.available_shells') on the Froxlor PostgreSQL instance. 4. Inspect /var/lib/extrausers/passwd for unauthorized shell entries (/bin/bash, /bin/sh, etc.) and manually correct any found. 5. Review SSH and FTP authentication logs for customer accounts that subsequently established interactive shell sessions. 6. Enforce network-level controls restricting SSH access to known administrator IP ranges, removing SSH as an accessible attack surface for customer accounts.

What systems are affected by CVE-2026-41235?

This vulnerability affects the following AI/ML architecture patterns: Shared hosting AI/ML deployments, Model serving infrastructure, ML development environments, Multi-tenant AI API hosting.

What is the CVSS score for CVE-2026-41235?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Shared hosting AI/ML deploymentsModel serving infrastructureML development environmentsMulti-tenant AI API hosting

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2, A.8.2

NIST AI RMF: GOVERN 6.2

What are the technical details?

Original Advisory

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.

Exploitation Scenario

An attacker operating a standard customer account on a Froxlor-hosted environment — perhaps a small hosting provider running AI inference endpoints or Jupyter notebooks for multiple tenants — identifies that shell delegation is enabled for their account. They log into the customer panel, obtain a valid CSRF token from the FTP management page, and submit a single crafted POST to /customer_ftp.php?page=accounts&action=edit&id=<ftp_id> with shell=/bin/bash in the body. The panel validates only that the shell string is well-formed, accepts the request, and stores /bin/bash in ftp_users.shell. Within minutes, Froxlor's master cron processes the REBUILD_NSSUSERS task, regenerating /var/lib/extrausers/passwd with /bin/bash as the attacker's OS-level login shell. The attacker then SSHs into the host using their FTP credentials, browses co-tenant directories containing model weights, API keys, and training datasets, exfiltrates sensitive AI artifacts, and establishes persistence by dropping an SSH authorized key.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.