The flaw lies in the Froxlor API endpoint Customers.update (and Admins.update) before version 2.3.6. The def_language parameter is not validated against the list of available language files, allowing an authenticated user to submit a path traversal payload that is saved to the database. When Language::loadLanguage() later builds a file path from this stored value and includes it with require, arbitrary PHP code is executed as the web server user, giving the attacker remote code execution capability.

All installations of Froxlor running a version older than 2.3.6 are vulnerable. The issue was addressed in release 2.3.6, so any deployment using a prior version must be considered at risk.

The CVSS base score of 10 indicates catastrophic impact, while the EPSS score is less than 1%, pointing to a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session to the API; once the malicious payload reaches the server, it can execute arbitrary PHP code as the web server account, potentially leading to full host compromise. Despite the low exploitation likelihood, the severity mandates prompt remediation.