Froxlor up to 2.3.10 Cron Task FileDir::makeCorrectDir fixed_homedir link following

Summaryinfo

A vulnerability has been found in Froxlor up to 2.3.10 and classified as problematic. This affects the function FileDir::makeCorrectDir of the component Cron Task. This manipulation of the argument fixed_homedir causes link following. This vulnerability is registered as CVE-2026-100715. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Froxlor up to 2.3.10 and classified as problematic. Affected by this vulnerability is the function FileDir::makeCorrectDir of the component Cron Task. The manipulation of the argument fixed_homedir with an unknown input leads to a link following vulnerability. The CWE definition for the vulnerability is CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As an impact it is known to affect integrity, and availability. The summary by CVE is:

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-100715 since 09/26/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 2.3.12 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion