CVE-2026-100713 in Froxlor
Summary
by MITRE • 09/26/2026
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APPEND|LOCK_EX, followed by chmod/chown/chgrp), with a database round-trip and file reads in between, and no path or file-descriptor pinning (no O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS)). On installations where the non-default setting system.allow_customer_shell=1 grants customers local shell access, a customer can atomically swap their ~/.ssh directory for a symlink after the check and before the write, causing the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and to chown /root/.ssh to the customer, resulting in full root compromise of the panel host. The cron re-runs on every interval, allowing unlimited attempts. This is a residual race that bypasses the check-time fix introduced for GHSA-mq5v-... . The issue is fixed in Froxlor 2.3.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Froxlor versions 2.3.10 and earlier represents a critical time-of-check to time-of-use race condition within the SSH key synchronization mechanism, specifically located in the SshKeys::generateFiles function of lib/Froxlor/Cron/System/SshKeys.php. This flaw arises from an insecure handling of file system paths during the generation of authorized keys for users with shell access privileges. The core technical deficiency lies in the validation logic implemented by FileDir::makeCorrectDir and makeCorrectFile, which perform containment checks only at the moment of verification rather than maintaining strict control over the filesystem path throughout the entire operation sequence. When the cron job executes as the root user to synchronize SSH keys, it resolves the live filesystem path again during the write phase using file_put_contents with flags for appending and exclusive locking, followed by ownership changes via chmod, chown, and chgrp commands. Crucially, there is no mechanism such as O_NOFOLLOW or openat2 with RESOLVE_NO_SYMLINKS to pin the file descriptor or prevent symlink traversal between the initial check and the final write operation. This gap allows an attacker to exploit the temporal window where the path validation has passed but the actual file modification has not yet occurred, effectively bypassing previous security fixes intended for similar issues like GHSA-mq5v-...
The operational impact of this vulnerability is severe when the system configuration includes the non-default setting system.allow_customer_shell set to 1, which grants customers local shell access on the host. An authenticated customer can leverage their existing shell privileges to perform an atomic swap of their ~/.ssh directory for a symbolic link pointing to /root/.ssh during the narrow interval between the check and write phases. Consequently, when the root-run cron job proceeds with appending the public key, it inadvertently writes into /root/.ssh/authorized_keys instead of the intended user-specific file. Furthermore, the subsequent chown command transfers ownership of the root SSH directory to the attacker's account. This sequence results in full remote code execution and complete compromise of the Froxlor panel host, as the attacker gains unrestricted access to the root account via SSH without needing a password or additional authentication factors beyond their existing customer credentials. The vulnerability is particularly dangerous because the cron job runs on every configured interval, providing unlimited opportunities for exploitation until the system state changes or the service is restarted.
From a classification perspective, this issue aligns with CWE-367, which defines time-of-check to time-of-use race conditions involving file systems where an attacker can change resources between checking and using them. It also relates closely to CWE-22, improper limitation of a pathname to a restricted directory, as the validation logic fails to prevent traversal outside the intended user home directory due to symlink manipulation. In terms of adversary tactics, this vulnerability facilitates privilege escalation from a low-privileged user account to root-level access, mapping to MITRE ATT&CK technique T1068 Exploitation for Privilege Escalation and potentially T1548 Abuse Elevation Control Mechanism if the system's permission models are manipulated. The attack vector is local but requires only authenticated customer access, making it a significant risk in multi-tenant hosting environments where Froxlor manages multiple domains and users with varying levels of shell access.
Mitigation strategies must prioritize immediate patching to version 2.3.12 or later, which addresses the race condition by implementing proper file descriptor pinning and atomic operations that prevent symlink substitution during critical sections. For systems unable to upgrade immediately, administrators should disable local shell access for customers by setting system.allow_customer_shell to 0 if such functionality is not strictly required. Additionally, enforcing strict SELinux policies or AppArmor profiles can restrict the cron job's ability to write outside designated directories and modify root-owned files regardless of race conditions. Regular auditing of SSH authorized_keys files across all user accounts, including root, should be implemented to detect any unauthorized modifications promptly. Security developers must ensure that future implementations utilize openat2 with appropriate resolve flags or equivalent OS-level primitives that guarantee path integrity from check through execution, thereby eliminating the window for TOCTOU exploitation in file system operations involving privileged processes.