CVE-2026-100716

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component with is_link(). An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace, then replace an intermediate path component with a symlink before the root-owned cron runs. The cron's `chown -R` then recursively changes ownership of the linked directory tree — for example /etc — to the customer's UID, yielding host root and cross-tenant compromise. Exploitation is deterministic and requires no race. This is an incomplete fix of GHSA-75h4-... The issue is fixed in Froxlor 2.3.12.

• CWE-59

• https://github.com/froxlor/froxlor/security/advisories/GHSA-2wjc-6mgx-hq42
• https://www.vulncheck.com/advisories/froxlor-before-2.3.12-privilege-escalation-via-symlink

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100710Froxlor through 2.3.10 does not filter sensitive columns fro…4.9
• CVE-2026-100711froxlor versions before 2.3.12 fail to invalidate existing p…7.5
• CVE-2026-100712froxlor through 2.3.10 disables a user's two-factor authenti…6.5
• CVE-2026-100713Froxlor 2.3.10 and earlier contain a time-of-check time-of-u…7.8
• CVE-2026-100714Froxlor before 2.3.12 does not restrict or escape the system…9.1
• CVE-2026-100715Froxlor through 2.3.10 is vulnerable to arbitrary file delet…9.6
• CVE-2026-100717froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100718Froxlor through 2.3.10 does not enforce the mail.allow_exter…7.1
• CVE-2026-100719Froxlor versions before 2.3.12 contain a credential disclosu…6.5
• CVE-2026-10072DreamMaker developed by Interinfo has an Arbitrary File Uplo…8.6
• CVE-2026-100720Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-s…8.7
• CVE-2026-10073DreamMaker developed by Interinfo has an Arbitrary File Read…8.7