https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-41233.htmlhttps://patchthecve.com/cve/CVE-2026-41233.htmlWed, 17 Jun 2026 10:46:21 +0000MEDIUM 5.4: Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used without validation when the calling reseller does not have the `customers_see_all` permission. This allows a reseller to attribute newly crehttps://patchthecve.com/cve/CVE-2026-41232.htmlhttps://patchthecve.com/cve/CVE-2026-41232.htmlWed, 17 Jun 2026 10:46:21 +0000MEDIUM 5.0: Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to `validateLocalDomainOwnerhttps://patchthecve.com/cve/CVE-2026-41231.htmlhttps://patchthecve.com/cve/CVE-2026-41231.htmlWed, 17 Jun 2026 10:46:21 +0000HIGH 7.5: Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other https://patchthecve.com/cve/CVE-2026-41230.htmlhttps://patchthecve.com/cve/CVE-2026-41230.htmlWed, 17 Jun 2026 10:46:21 +0000HIGH 8.5: Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g.https://patchthecve.com/cve/CVE-2026-41229.htmlhttps://patchthecve.com/cve/CVE-2026-41229.htmlWed, 17 Jun 2026 10:46:20 +0000CRITICAL 9.1: Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the APhttps://patchthecve.com/cve/CVE-2026-41228.htmlhttps://patchthecve.com/cve/CVE-2026-41228.htmlWed, 17 Jun 2026 10:46:20 +0000CRITICAL 9.9: Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated customer can set `def_language` to a path tra