Arbitrary File Deletion in Froxlor via Symlink Following

Froxlor versions through 2.3.10 contain a critical vulnerability in the deleteFtpData cron task (Task 8). When an FTP account is deleted, the application queues this task to clean up associated data. The task execution flow invokes FileDir::makeCorrectDir() without the $fixed_homedir argument, causing the system to skip necessary symlink component path walking. Subsequently, the application executes a recursive 'rm -rf' operation with root privileges on the resulting path.

Because the application appends a trailing slash to the path before execution, the underlying GNU rm utility is forced to dereference symlinks. An authenticated user with write access to their designated FTP home directory can place a symbolic link in the target path after the task is queued but before the cron job executes. This allows the attacker to redirect the recursive deletion operation to arbitrary directories on the host filesystem, resulting in cross-tenant data loss and host-level denial of service. This vulnerability is addressed in Froxlor version 2.3.12.

Attack Chain

1. Attacker obtains authenticated access to an FTP account managed by the target Froxlor instance.
2. Attacker initiates the deletion of their own FTP account via the Froxlor interface, triggering the scheduling of the deleteFtpData cron task.
3. Attacker identifies the target path that will be processed by the upcoming root-privileged cron cleanup job.
4. Attacker plants a symbolic link pointing to a critical system directory (e.g., /etc or a peer tenant's data directory) within the expected FTP home path.
5. The system root user executes the scheduled cron task, which resolves the path containing the attacker-controlled symlink.
6. The 'rm -rf' command dereferences the symlink and recursively deletes the contents of the target directory.
7. Final impact is realized as system instability, data loss, or total host denial of service.

Impact

Successful exploitation allows an authenticated customer to perform arbitrary file deletion with root privileges. This can result in the destruction of cross-tenant data, the deletion of critical system configuration files, or a complete host denial of service. Given the broad permissions of the cron task, the potential for widespread data corruption is significant.

Recommendation

Prioritize the update of all Froxlor installations to version 2.3.12 or later to include the patch for CVE-2026-100715. For environments that cannot be patched immediately, restrict user access to FTP home directories and audit the filesystem for unexpected symbolic links located within directories managed by Froxlor's cleanup cron tasks. Ensure that file system auditing is enabled to track 'rm' executions by the root user that target directories outside of expected user homedirs.