Description

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component with is_link(). An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace, then replace an intermediate path component with a symlink before the root-owned cron runs. The cron's `chown -R` then recursively changes ownership of the linked directory tree — for example /etc — to the customer's UID, yielding host root and cross-tenant compromise. Exploitation is deterministic and requires no race. This is an incomplete fix of GHSA-75h4-... The issue is fixed in Froxlor 2.3.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-26T14:16:57.583Z",
  "pubdate": "2026-09-26T14:16:57.583Z",
  "executiveSummary": "Froxlor versions 2.3.10 and earlier contain a critical vulnerability in the customer data-export (DataDump) cron process, resulting in an arbitrary file ownership modification flaw. This security defect allows an authenticated customer with export privileges to manipulate file system paths to trick a root-owned cron job into executing recursive chown operations on sensitive system directories.\nThe vulnerability is categorized as an improper validation of file paths, specifically concerning symlink attacks within directory structures. By exploiting the failure to adequately sanitize intermediate path components, an attacker can escalate privileges from a standard customer account to root-level access on the host system, facilitating complete server compromise and cross-tenant data access. Exploitation is deterministic and does not require complex race conditions, making this a high-severity security risk. The issue stems from an incomplete fix regarding path-component traversal and inadequate symlink protection mechanisms. Users are strongly advised to upgrade to Froxlor 2.3.12 or later to remediate this flaw.",
  "technicalDetails": "The root cause of this vulnerability lies in the flawed directory validation logic within Froxlor\\FileDir::makeCorrectDir() and the insufficient verification checks in ExportCron.php. The makeCorrectDir() function contains an off-by-one error during its path-component iteration, which causes the logic to erroneously skip the first path segment below the designated customer home directory. This bypasses security boundaries intended to constrain file operations to the customer's legitimate webspace.\nThe attack flow leverages the scheduled DataDump cron job, which runs with root privileges. An authenticated customer with the data-export feature enabled initiates the following sequence: First, the user schedules a data export operation destined for a subdirectory within their webspace. Before the execution of the cron job, the attacker replaces an intermediate directory component in the target path with a symbolic link (symlink) pointing to a sensitive system directory, such as /etc. Because the guard check in ExportCron.php only inspects the final path component using is_link()—and ignores the intermediate segments—the symlink successfully evades the security filter.\nWhen the root-owned cron job executes, it processes the directory structure to perform necessary file operations. Due to the path-component validation failure, the process follows the malicious symlink. The subsequent execution of chown -R on the target directory results in the recursive modification of ownership permissions. By pointing the symlink to system-critical directories, the attacker forces the cron job to change the ownership of these directories and their contents to the attacker's UID.\nThis leads to a complete host compromise, as the attacker gains write access to system configuration files, allowing for the execution of arbitrary code as root or the subversion of authentication mechanisms. Furthermore, since the cron job operates across the host, this flaw enables cross-tenant compromise by granting the attacker control over other users' data stored on the same filesystem. The vulnerability is deterministic, requiring no race conditions, and is present in versions 2.3.10 and earlier, representing an incomplete mitigation of the previously identified GHSA-75h4- issue."
}