CVE-2026-100716: Froxlor before 2.3.12 Privilege Escalation via Symlink
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component with islink(). An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace, then replace an intermediate path component with a symlink before the root-owned cron runs. The cron's chown -R then recursively changes ownership of the linked directory tree — for example /etc — to the customer's UID, yielding host root and cross-tenant compromise. Exploitation is deterministic and requires no race. This is an incomplete fix of GHSA-75h4-... The issue is fixed in Froxlor 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor customer can exploit it if their account has the DataDump export feature enabled. The attacker must be able to create directories in their own webspace and replace an intermediate export-path component with a symlink before the root-owned export cron executes.
Are installations affected by default?
Exposure depends on whether customer DataDump exports are enabled for an authenticated customer account. The vulnerable behavior is in the root-owned cron processing of a customer-scheduled export, rather than an unauthenticated request path.
What is the impact if exploitation succeeds?
The root-owned cron can recursively change ownership of the directory tree reached through the symlink to the customer's UID. If the symlink targets a sensitive tree such as /etc, this can yield host-root access and compromise other tenants.
Is exploitation race-dependent?
No. The described exploit is deterministic and does not require winning a race condition; the symlink is placed after scheduling the export and before the cron runs.
What can be done before patching?
Disable or withhold the DataDump export feature from customer accounts to prevent them from scheduling the affected export operation. Upgrade to Froxlor 2.3.12 when possible.