CVE-2026-100713

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APPEND|LOCK_EX, followed by chmod/chown/chgrp), with a database round-trip and file reads in between, and no path or file-descriptor pinning (no O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS)). On installations where the non-default setting system.allow_customer_shell=1 grants customers local shell access, a customer can atomically swap their ~/.ssh directory for a symlink after the check and before the write, causing the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and to chown /root/.ssh to the customer, resulting in full root compromise of the panel host. The cron re-runs on every interval, allowing unlimited attempts. This is a residual race that bypasses the check-time fix introduced for GHSA-mq5v-... . The issue is fixed in Froxlor 2.3.12.

• CWE-367

• https://github.com/froxlor/froxlor/security/advisories/GHSA-927x-9jfh-mq42
• https://www.vulncheck.com/advisories/froxlor-before-2.3.12-privilege-escalation-via-ssh-key-sync

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100708Froxlor before 2.3.13 returns the ssl_key_file column — whic…7.1
• CVE-2026-100709Froxlor through 2.3.10 stores only a numeric user ID in reme…7.5
• CVE-2026-10071DreamMaker developed by Interinfo has an Arbitrary File Uplo…9.8
• CVE-2026-100710Froxlor through 2.3.10 does not filter sensitive columns fro…4.9
• CVE-2026-100711froxlor versions before 2.3.12 fail to invalidate existing p…7.5
• CVE-2026-100712froxlor through 2.3.10 disables a user's two-factor authenti…6.5
• CVE-2026-100714Froxlor before 2.3.12 does not restrict or escape the system…9.1
• CVE-2026-100715Froxlor through 2.3.10 is vulnerable to arbitrary file delet…9.6
• CVE-2026-100716Froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100717froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100718Froxlor through 2.3.10 does not enforce the mail.allow_exter…7.1
• CVE-2026-100719Froxlor versions before 2.3.12 contain a credential disclosu…6.5