CVE-2026-100715 is a critical symlink-following flaw in Froxlor's FTP data deletion cron task. An authenticated customer could make a root-run rm -rf delete any directory tree on the host.
What Is It
The flaw is in Froxlor's cron task 8 (deleteFtpData), which is queued when an FTP account is deleted. The task calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped. The task then runs rm -rf as root on the resulting path. The only protection is a set of string-level guards. makeCorrectDir() appends a trailing slash, so GNU rm follows a symlink whether it is an intermediate path component or the final one.
A customer who can write to the FTP home directory could plant a symlink after the task is queued and before the cron job runs. According to the advisory, the root cron job would then recursively delete whatever directory tree the symlink points to. The weakness is classified as CWE-59 (Improper Link Resolution Before File Access).
Why It Matters
NVD lists a CVSS v3.1 base score of 9.6 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. VulnCheck gives a CVSS v4.0 score of 8.5 (HIGH). The attack is reachable over the network and has low complexity. It needs only low privileges and no user interaction. The scope is changed, and the integrity and availability impacts are high.
On shared hosting, this means one customer could delete other tenants' data and potentially cause a denial of service on the host.
CVE-2026-100715 does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. No active exploitation has been confirmed, and no exploitation data was available for this brief.
What's Vulnerable
- Vendor/Product: froxlor / froxlor
- Affected: the description says "through 2.3.10," but the structured affected data marks all versions from 0 up to (but not including) 2.3.12 as affected
- Unaffected: 2.3.12
Exploitation requires an authenticated customer account with write access to an FTP home directory.
Patch Status
The issue is fixed in Froxlor 2.3.12. Administrators should upgrade to 2.3.12 or later. Because the CVE is not listed in KEV, CISA has set no required action or due date for it. NVD shows the record's status as "Deferred" (published 2026-09-26).