Froxlor EUVD-2026-87688

Requires an authenticated Froxlor customer account (PR:L) with write access to an FTP home directory on a version through 2.3.10. The attacker must trigger deletion of an FTP account to enqueue root cron task 8 (deleteFtpData), then win a TOCTOU race by planting a symlink (as an intermediate or final path component of the target) in the window between task insertion and cron execution. Exploitation is limited by: needing valid low-privilege credentials, the timing/race window against the cron scheduler, and reliance on the deleteFtpData code path that skips the symlink component walk (makeCorrectDir() without $fixed_homedir) combined with GNU rm dereferencing a trailing-slash symlink. Impact is deletion-only (no data read); most damaging in multi-tenant hosting deployments where the root cron can reach other tenants' or system directories.

This is a genuine, actionable priority within Froxlor deployments, though its exploitability is gated by a timing race rather than being a trivial one-shot. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H/VA:H, SI:H/SA:H = 8.5 High) captures the severe impact - arbitrary directory-tree deletion executed by a root cron job with cross-tenant and host-availability consequences - but its AC:L/AT:N understate the real precondition: the description explicitly requires the attacker to plant a symlink in the TOCTOU window between FTP-account-deletion task insertion and cron execution, which is a race condition better modeled as AT:P (4.0) or AC:H (3.1). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV is consistent with a newly disclosed (2026), niche-product, authentication-and-race-gated flaw rather than mass exploitation. Confidentiality is not impacted (deletion-only), so despite the high headline score this is fundamentally an integrity/availability destruction bug requiring an authenticated foothold - a real priority for multi-tenant Froxlor operators, lower urgency for single-tenant or non-Froxlor environments.

An authenticated Froxlor customer with write access to their own FTP home directory deletes an FTP account (queuing root cron task 8, deleteFtpData) and, before the cron runs, plants a symlink at the target path pointing to another tenant's data or a critical system directory. When the root cron executes 'rm -rf' on the trailing-slash path, GNU rm dereferences the symlink and recursively deletes the pointed-to tree, destroying cross-tenant data and potentially rendering the host inoperable. No public exploit code is identified at time of analysis; success depends on winning the insertion-to-execution timing window.