CVE-2026-41231: Froxlor Makecorrectdir Missing Fixed Homedir
FileDir::makeCorrectDir() is called on a path built by concatenating a customer's documentroot with user-supplied data (DataDump export path), but without the second $fixed_homedir argument. Without that argument the symlink-escape validation in FileDir::makeCorrectDir() (lines 134-157) is skipped entirely, so a customer-owned symlink inside their home direc
PHPgreprules fetch cve-2026-41231-froxlor-makecorrectdir-missing-fixed-homedir --engine opengrepDescription
FileDir::makeCorrectDir() is called on a path built by concatenating a customer's documentroot with user-supplied data (DataDump export path), but without the second $fixed_homedir argument. Without that argument the symlink-escape validation in FileDir::makeCorrectDir() (lines 134-157) is skipped entirely, so a customer-owned symlink inside their home direc
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.