CVE-2026-100713
Deferred Deferred - Pending Action

Time-of-Check Time-of-Use Race Condition in Froxlor SSH Key Synchronization

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APPEND|LOCK_EX, followed by chmod/chown/chgrp), with a database round-trip and file reads in between, and no path or file-descriptor pinning (no O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS)). On installations where the non-default setting system.allow_customer_shell=1 grants customers local shell access, a customer can atomically swap their ~/.ssh directory for a symlink after the check and before the write, causing the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and to chown /root/.ssh to the customer, resulting in full root compromise of the panel host. The cron re-runs on every interval, allowing unlimited attempts. This is a residual race that bypasses the check-time fix introduced for GHSA-mq5v-... . The issue is fixed in Froxlor 2.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100713
EUVD
EUVD-2026-87686

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
froxlor froxlor to 2.3.12 (exc)
froxlor froxlor 2.3.12
froxlor froxlor From 2.3.0 (inc) to 2.3.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100713 is a time-of-check time-of-use (TOCTOU) race condition in Froxlor 2.3.10 and earlier. The SSH key synchronization cron job checks the path of the authorized_keys file but re-resolves it later when writing. An attacker with shell access can replace a symlink in their home directory with one pointing to root's .ssh directory, tricking the cron job into appending their public key to root's authorized_keys file. This grants full root access to the panel host.

Detection Guidance

Check if your Froxlor version is 2.3.10 or earlier by running: froxlor --version. If vulnerable, inspect SSH key synchronization logs for unauthorized root access attempts in /var/log/cron.log or /var/log/syslog. Look for symlink swaps in customer home directories by running: find /home -type l -name .ssh -ls. Monitor /root/.ssh/authorized_keys for unexpected public key additions.

Impact Analysis

If you run Froxlor 2.3.10 or earlier with the non-default setting system.allow_customer_shell=1 enabled, an attacker with customer shell access can exploit this to gain full root privileges on the server. The cron job runs repeatedly, allowing unlimited attempts until patched.

Compliance Impact

This vulnerability could lead to unauthorized root access, compromising system integrity and data confidentiality. For GDPR, it risks unauthorized access to personal data. For HIPAA, it threatens protected health information security. Compliance violations may occur due to failed access controls and data breaches.

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Disable the non-default setting system.allow_customer_shell=1 if enabled. Temporarily revoke shell access for all customers until the upgrade is complete. Review and remove any unauthorized public keys from /root/.ssh/authorized_keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100713. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart