Froxlor EUVD-2026-87686

Requires the NON-DEFAULT setting system.allow_customer_shell=1, which grants customers interactive local shell access on the host; without it the attack is unreachable. The attacker must be an authenticated Froxlor customer (PR:L) with a shell account, and must win a TOCTOU race by atomically swapping their ~/.ssh directory for a symlink in the window between FileDir::makeCorrectDir()/makeCorrectFile() validation and the root cron's file_put_contents/chown, which lack O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS) pinning. The race is limited by timing (AC:H) but the SSH-key-sync cron re-runs every interval, permitting unlimited attempts until success.

This is a genuine root-compromise primitive but tightly gated, making it a moderate real-world priority rather than an emergency. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) is misleading: the description makes clear this is a LOCAL race requiring an interactive shell on the host, not a network attack, and the outcome is full root - inconsistent with the vector's VI:N/VA:N (integrity/availability = None). No EPSS, no CISA KEV entry, and no public exploit code are provided, so there is no evidence of active exploitation - this is a theoretical TOCTOU window disclosed by VulnCheck. The strongest mitigating factor is that exploitation requires the non-default setting system.allow_customer_shell=1; on default installs the attack surface does not exist. Against that, the impact is maximal (root) and the cron re-runs on every interval giving the attacker unlimited race attempts, which materially raises the practical win probability despite the AC:H timing requirement. Net: high technical impact, narrow reachability - patch on customer-shell-enabled multi-tenant panels, lower urgency elsewhere.

On a Froxlor host where system.allow_customer_shell=1, an authenticated customer with local shell access runs a loop that atomically renames their ~/.ssh directory to a symlink pointing at /root/.ssh immediately after the root-run SshKeys cron validates the path but before it writes. When it wins the race, the root cron appends the customer's SSH public key to /root/.ssh/authorized_keys and chowns /root/.ssh to the customer, giving passwordless root SSH. No public exploit code is identified at time of analysis, but the cron's repeated execution makes the race winnable with brute-force persistence.