Symlink Path Traversal in Froxlor Admin Panel

Executive Summary

CVE-2026-100716 is a critical privilege escalation flaw in Froxlor versions 2.3.10 and earlier. It involves the DataDump export cron job failing to validate intermediate path components during export operations. An off-by-one error in Froxlor\FileDir::makeCorrectDir() skips checking the first path segment below the customer home directory, while ExportCron.php only verifies the final component for symlinks. This allows an authenticated customer to schedule an export into a legitimate subdirectory, replace an intermediate path component with a symlink, and trick the cron's chown -R command into recursively changing ownership of linked directories like /etc to their UID, enabling host root or cross-tenant compromise.

The vulnerability is deterministic and does not require race conditions. It bypasses a previous incomplete fix (GHSA-75h4) that only checked the final path component. The issue is fully resolved in Froxlor 2.3.12.

Useful 0 Not Useful 0

Detection Guidance

Check Froxlor version with 'froxlor --version' or via the web interface. Look for suspicious cron jobs in /etc/cron* or /var/spool/cron/crontabs related to Froxlor DataDump exports. Monitor for unexpected ownership changes in system directories like /etc or /home using 'ls -la /etc' or 'find / -uid <customer_uid> 2>/dev/null'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated customer with export feature access to escalate privileges to host root or compromise other tenants. By exploiting the symlink path traversal, an attacker can gain ownership of critical system directories like /etc, /etc/shadow, or other tenants' webspaces. This could lead to complete system compromise, data theft, or disruption of services. The impact is severe due to the deterministic nature of the exploit and the lack of required race conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability severely impacts compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data and system resources. GDPR requires protection of personal data and breach notification within 72 hours; this flaw could lead to unauthorized data exposure triggering mandatory reporting. HIPAA mandates strict access controls for protected health information; privilege escalation compromises these controls. The vulnerability undermines security measures required by these standards, potentially resulting in regulatory fines, legal liabilities, and reputational damage for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Disable the DataDump export feature for all customers until patched. Review cron jobs for Froxlor and revoke any unauthorized ownership changes. Implement stricter path validation in cron scripts and use safer file operations like openat2(RESOLVE_NO_SYMLINKS).

Useful 0 Not Useful 0