CVE-2026-100715: Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixedhomedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An authenticated Froxlor customer who can write to an FTP home directory can exploit it. The attack targets the interval after an FTP account deletion queues the cleanup task and before the root-run cron task executes it.
Are default deployments affected?
Deployments running Froxlor through 2.3.10 are affected when the FTP data deletion cron task is used. The vulnerable cleanup task is queued when an FTP account is deleted and runs rm -rf as root.
What is the impact of successful exploitation?
An attacker can cause the root cron job to recursively delete arbitrary directory trees by placing a symlink in the FTP home directory. This can destroy data belonging to other tenants and cause host denial of service.
What should be done if upgrading is not immediately possible?
Prevent untrusted customers from writing to FTP home directories and avoid deleting FTP accounts in a way that queues the affected cleanup task until remediation is available. Review queued FTP deletion tasks and their referenced paths before allowing the cron task to run.
How can administrators determine whether they are affected?
Check the installed Froxlor version and upgrade to 2.3.12, which fixes the issue. Systems running through 2.3.10 should be treated as vulnerable, particularly if FTP account deletion queues cron task 8, deleteFtpData.