Froxlor up to 2.3.10 DataDump ExportCron.php makeCorrectDir off-by-one

Summaryinfo

A vulnerability, which was classified as critical, has been found in Froxlor up to 2.3.10. Affected by this vulnerability is the function Froxlor\FileDir::makeCorrectDir of the file ExportCron.php of the component DataDump. The manipulation leads to off-by-one. This vulnerability is listed as CVE-2026-100716. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Froxlor up to 2.3.10. This issue affects the function Froxlor\FileDir::makeCorrectDir of the file ExportCron.php of the component DataDump. The manipulation with an unknown input leads to a off-by-one vulnerability. Using CWE to declare the problem leads to CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component with is_link(). An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace, then replace an intermediate path component with a symlink before the root-owned cron runs. The cron's `chown -R` then recursively changes ownership of the linked directory tree — for example /etc — to the customer's UID, yielding host root and cross-tenant compromise. Exploitation is deterministic and requires no race. This is an incomplete fix of GHSA-75h4-... The issue is fixed in Froxlor 2.3.12.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-100716 since 09/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:ExportCron.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.3.12 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion