Executive brief
Froxlor is a hosting control panel that manages servers and customer accounts. On systems configured to allow customers local shell access, a customer can exploit a timing gap in the SSH key synchronization process to trick the panel's root-level cron job into writing their SSH key to root's authorized_keys file, granting them complete control of the panel server. The vulnerability requires repeated attempts but succeeds consistently because the cron runs at regular intervals.
Technical details
The SSH key cron job (SshKeys::generateFiles) performs symlink validation at check time but re-resolves the filesystem path at write time without path pinning (no O_NOFOLLOW or openat2 RESOLVE_NO_SYMLINKS), introducing a TOCTOU race window. A customer with shell access can swap their ~/.ssh directory with a symlink to /root/.ssh between validation and file_put_contents, causing root-owned operations to write to the target file and transfer ownership. This bypasses a prior containment check fix because the validation is not re-verified before write operations.
Affected products
- Froxlor Froxlor through 2.3.10
Timeline
- 2026-09-26: disclosed: CVE-2026-100713 and GHSA-927x-9jfh-mq42 published
- 2026-09-26: patched: Fix released in Froxlor 2.3.12