Description

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-26T14:16:57.427Z",
  "pubdate": "2026-09-26T14:16:57.427Z",
  "executiveSummary": "Froxlor versions through 2.3.10 contain a critical vulnerability involving arbitrary file deletion via symlink following in the FTP data deletion cron task.\nThe vulnerability occurs within cron task 8 (deleteFtpData), which is executed with root privileges when an FTP account is removed.\nAn authenticated customer with write access to their FTP home directory can exploit this by planting a symlink, tricking the root-privileged cron job into deleting arbitrary directory trees.\nThis flaw allows for cross-tenant data destruction and host-level denial of service.\nThe root cause is the improper handling of path validation in the FileDir::makeCorrectDir() function when invoked without strict path enforcement.\nThe vulnerability is remediated in version 2.3.12.",
  "technicalDetails": "The vulnerability resides in the interaction between the FTP account deletion workflow and the asynchronous execution of cron task 8 (deleteFtpData). When an FTP account is deleted, the system queues a cleanup operation that invokes the FileDir::makeCorrectDir() function. Critically, the implementation fails to provide the $fixed_homedir argument during this call. This omission circumvents the internal symlink component walk and path validation mechanisms intended to prevent unauthorized directory traversal.\nBecause FileDir::makeCorrectDir() appends a trailing slash to the target directory path, it alters the behavior of the subsequent 'rm -rf' command executed by the root-privileged cron process. Under GNU rm, the inclusion of a trailing slash triggers the dereferencing of symlinks, regardless of whether the symlink is an intermediate path component or the terminal node. Consequently, if an authenticated user creates a symlink within their accessible FTP home directory space after the task is queued but before the cron job executes, they can control the target path processed by the removal command.\nThe attack flow follows a specific sequence: First, the attacker identifies that an FTP account deletion is pending or triggers a deletion event for an account they control. Second, during the interval between the account removal request and the periodic execution of the cron task, the attacker populates the directory path with a symlink pointing to a sensitive system location or other tenant's data. Third, the root-privileged cron daemon executes 'rm -rf' on the path constructed by the vulnerable function. Because the function does not validate the path against the expected root directory, the shell recursively deletes whatever path the symlink resolves to.\nThis exploit requires that the attacker has authenticated access to an FTP account on the system. The impact is significant, as it grants an unprivileged tenant the ability to delete arbitrary files and directories on the underlying host, leading to cross-tenant data corruption and total system denial of service. The logic failure in path handling renders the string-level security guards insufficient to prevent the symlink traversal."
}