Froxlor up to 2.3.10 SSH Key Synchronization SshKeys.php SshKeys::generateFiles toctou

Summaryinfo

A vulnerability was found in Froxlor up to 2.3.10. It has been declared as problematic. Impacted is the function SshKeys::generateFiles of the file lib/Froxlor/Cron/System/SshKeys.php of the component SSH Key Synchronization. Executing a manipulation can lead to toctou. This vulnerability appears as CVE-2026-100713. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Froxlor up to 2.3.10. It has been declared as problematic. This vulnerability affects the function SshKeys::generateFiles of the file lib/Froxlor/Cron/System/SshKeys.php of the component SSH Key Synchronization. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APPEND|LOCK_EX, followed by chmod/chown/chgrp), with a database round-trip and file reads in between, and no path or file-descriptor pinning (no O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS)). On installations where the non-default setting system.allow_customer_shell=1 grants customers local shell access, a customer can atomically swap their ~/.ssh directory for a symlink after the check and before the write, causing the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and to chown /root/.ssh to the customer, resulting in full root compromise of the panel host. The cron re-runs on every interval, allowing unlimited attempts. This is a residual race that bypasses the check-time fix introduced for GHSA-mq5v-... . The issue is fixed in Froxlor 2.3.12.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-100713 since 09/26/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

By approaching the search of inurl:lib/Froxlor/Cron/System/SshKeys.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.3.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion