Froxlor server administration software versions prior to 2.3.6 contain a path traversal vulnerability in the API endpoints Customers.update and Admins.update. The def_language parameter is not properly validated against available language files, allowing authenticated users to inject path traversal payloads. When Language::loadLanguage() processes these malicious paths, it can lead to arbitrary PHP code execution as the web server user. The vulnerability has been patched in version 2.3.6.