Is CVE-2026-100713 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100713 being exploited in the wild.

How severe is CVE-2026-100713?

High severity, with a CVSS score of 7.8, published 26 September 2026.

Is there a fix for CVE-2026-100713?

A patch was published on 2026-09-26: Fix released in Froxlor 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100713 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-100713?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100713: Froxlor SSH key synchronization race condition leading to root access

CVE-2026-100713 · Severity: high · CVSS 7.8 · Published 2026-09-26

Froxlor is a hosting control panel that manages servers and customer accounts. On systems configured to allow customers local shell access, a customer can exploit a timing gap in the SSH key synchronization process to trick the panel's root-level cron job into writing their SSH key to root's authorized_keys file, granting them complete control of the panel server. The vulnerability requires repeated attempts but succeeds consistently because the cron runs at regular intervals.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-100713 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100713 being exploited in the wild.
How severe is CVE-2026-100713?: High severity, with a CVSS score of 7.8, published 26 September 2026.
Which products and versions are affected?: Froxlor through 2.3.10.
Is there a fix for CVE-2026-100713?: A patch was published on 2026-09-26: Fix released in Froxlor 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100713 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-100713?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SSH key cron job (SshKeys::generateFiles) performs symlink validation at check time but re-resolves the filesystem path at write time without path pinning (no O_NOFOLLOW or openat2 RESOLVE_NO_SYMLINKS), introducing a TOCTOU race window. A customer with shell access can swap their ~/.ssh directory with a symlink to /root/.ssh between validation and file_put_contents, causing root-owned operations to write to the target file and transfer ownership. This bypasses a prior containment check fix because the validation is not re-verified before write operations.

Affected products

Froxlor Froxlor through 2.3.10

Timeline

2026-09-26: disclosed: CVE-2026-100713 and GHSA-927x-9jfh-mq42 published
2026-09-26: patched: Fix released in Froxlor 2.3.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.