A critical (CVSS 9.9) symlink-following flaw in Froxlor's customer data-export cron lets an authenticated customer make the root-owned job chown system directories such as /etc to their own account, which gives them root on the host and access to other tenants.
What Is It
CVE-2026-100716 is a link-following vulnerability (CWE-59) in Froxlor, a server administration panel. It sits in the customer data-export (DataDump) cron, which does not validate the middle parts of the export destination path. There are two bugs:
Froxlor\FileDir::makeCorrectDir()has an off-by-one error in how it walks the path. It skips the first directory below the customer home directory.- The guard in
ExportCron.phpusesis_link()on the final path component only.
A customer with the export feature enabled can schedule an export into a real subdirectory of their own webspace. Before the root-owned cron runs, they swap a directory in the middle of that path for a symlink. The cron's chown -R then follows the link and recursively gives the customer's UID ownership of the target tree, for example /etc.
Why It Matters
- Impact: An attacker gains root on the host and can compromise other tenants on the same server.
- Reliability: The advisory describes exploitation as deterministic, with no race to win.
- Low barrier: The attack works over the network with low complexity and needs only low privileges (an authenticated customer account). No user interaction is required. CVSS 3.1 is 9.9 Critical (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 is 9.4 Critical. - Regression: This is an incomplete fix of an earlier Froxlor advisory, so updates made for that earlier issue do not protect against this one.
Exploitation status: The supplied CISA KEV entry is empty, so this CVE is not in the KEV catalog and KEV does not confirm active exploitation.
What's Vulnerable
- Product: Froxlor (vendor: froxlor)
- Affected versions:
- The description says versions 2.3.10 and earlier are affected.
- The structured affected-version data lists every version before 2.3.12 as affected, which also covers 2.3.11. Treat 2.3.11 as vulnerable.
- Unaffected: 2.3.12
- Precondition: The attacker needs an authenticated customer account with the data-export feature enabled.
Patch Status
The fix is in Froxlor 2.3.12. Upgrade to 2.3.12 or later. Because no CISA KEV entry exists, there is no KEV-mandated required action or due date. NVD lists the record's status as "Deferred."