CVE-2026-100715 in Froxlor
Summary
by MITRE • 09/26/2026
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Froxlor versions up to 2.3.10 represents a critical security flaw rooted in improper handling of symbolic links during file system operations, specifically within the automated FTP data deletion mechanism. This issue is classified under CWE-59 as Improper Link Resolution Before File Access and falls under MITRE ATT&CK technique T1486, Data Encrypted for Impact, when considering the potential for destructive actions leading to denial of service or data loss. The core technical failure occurs in cron task number eight, designated as deleteFtpData, which is triggered whenever an FTP account is removed from the system. This task invokes a utility function named FileDir::makeCorrectDir() with the intent of sanitizing directory paths to prevent path traversal attacks. However, the implementation fails to pass the $fixed_homedir argument during this invocation. The absence of this specific parameter causes the internal logic that validates and restricts symlink resolution to be bypassed entirely. Consequently, the function does not perform the necessary checks to ensure that symbolic links are resolved safely or rejected if they point outside the intended directory structure.
Following the execution of FileDir::makeCorrectDir(), the system proceeds to execute a shell command using rm -rf on the resulting path with root privileges. The security controls in place rely solely on string-level guards, which are insufficient against sophisticated symlink attacks because GNU rm inherently dereferences symbolic links when processing paths that contain them as either intermediate components or final targets. This behavior means that if an attacker can influence the content of the directory being processed, they can manipulate the file system state to redirect the deletion operation away from the intended FTP home directory and toward arbitrary locations on the host operating system. The vulnerability is particularly dangerous because it allows for cross-tenant data destruction in multi-user hosting environments where Froxlor manages multiple customer accounts. An authenticated user with write access to their own FTP home directory can exploit this race condition by creating a symbolic link that points to sensitive system directories or other tenants' data stores between the moment the deletion task is queued and when it actually executes via the cron scheduler.
The operational impact of this vulnerability is severe, leading directly to host denial of service through the recursive removal of critical system files or extensive cross-tenant data loss. Because the command runs as root, there are no permission-based barriers preventing the destruction of essential operating system components, configuration files, or other users' private data. This lack of isolation undermines the fundamental security model of shared hosting platforms, where tenant boundaries must be strictly enforced to prevent lateral movement and privilege escalation effects that result in catastrophic data loss. The attack vector requires only authenticated access with write permissions to an FTP account, which is a relatively low barrier for malicious insiders or compromised accounts.
Mitigation strategies primarily involve upgrading the Froxlor installation to version 2.3.12 or later, where this specific implementation flaw has been corrected by ensuring that symlink resolution is properly handled and restricted within the file deletion routines. In environments where immediate patching is not feasible, administrators should implement strict access controls on FTP home directories to limit write permissions only to necessary operations and consider disabling automatic cron-based deletions if they are not strictly required. Additionally, deploying host-based intrusion detection systems that monitor for unusual patterns of root-level recursive file deletions can provide early warning indicators of exploitation attempts. Regular audits of scheduled tasks and their associated privilege levels are also recommended to ensure that no other components within the application suffer from similar improper link resolution vulnerabilities.