Froxlor CVE-2026-100716

Requires an authenticated Froxlor customer account (PR:L) whose account has the data-export/DataDump feature explicitly enabled, on a Froxlor instance at version 2.3.10 or earlier (or any version below 2.3.12, including those with only the earlier incomplete GHSA fix applied). The attacker must be able to schedule an export into a genuine subdirectory of their own webspace and place a symlink at an intermediate path component before the root-owned export cron executes; because the flaw is a deterministic off-by-one plus a final-component-only is_link() guard, no race timing is needed. Exploitation is limited to deployments where untrusted customers have panel accounts with export enabled - primarily multi-tenant shared-hosting environments - and does not apply to single-operator installs or accounts without the export feature.

This is a genuinely high-priority privilege-escalation flaw, not a high-CVSS-but-low-risk paper cut. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) reflects the reality: a low-privileged authenticated customer with the export feature enabled turns their own tenant account into host root and cross-tenant compromise via a root-owned cron's chown -R following a planted symlink. The description explicitly states exploitation is deterministic and requires no race window, which removes the usual reliability caveat that dampens symlink/TOCTOU bugs - AC:L is well justified. No EPSS score, CISA KEV listing, or public POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; however, the low complexity, deterministic nature, and root outcome make this attractive to any authenticated tenant on a shared host. One important nuance: this is described as an incomplete fix of a prior advisory (GHSA-75h4-...), meaning environments that only applied the earlier patch remain exposed - defenders must confirm they are on 2.3.12, not merely 'patched.' The main limiting factor is the PR:L requirement (a valid customer account with the export/DataDump feature enabled), so risk concentrates on multi-tenant shared-hosting deployments where untrusted customers have panel accounts.

An attacker who holds (or purchases) a legitimate Froxlor customer account with the data-export feature enabled schedules a DataDump export into a real subdirectory of their own webspace, then replaces an intermediate path component of that destination with a symlink pointing at a sensitive tree such as /etc before the root-owned export cron runs. Because makeCorrectDir()'s off-by-one skips validating the first segment below the home directory and ExportCron.php's is_link() guard only checks the final component, the cron's recursive chown -R changes ownership of the linked tree to the customer's UID, granting host root and cross-tenant access. No public POC is identified in the input, but exploitation is described as deterministic with no race required.