Executive brief
Froxlor is a web hosting control panel that manages FTP accounts and file storage for multiple customers. When an FTP account is deleted, a background cron task running as root recursively removes the account's files, but it does not properly validate symlinks. An authenticated customer can plant a malicious symlink in their FTP directory before the cleanup task runs, causing the root cron job to delete arbitrary files and directories across the system, leading to data destruction affecting other customers and server outages.
Technical details
The vulnerability exists in the deleteFtpData cron task (task 8), which calls FileDir::makeCorrectDir() without the $fixed_homedir parameter, skipping symlink component resolution. The function then appends a trailing slash and executes 'rm -rf' as root with only string-level path validation. An authenticated customer with write access to their FTP homedir can create a symlink (intermediate or final component) that redirects the recursive deletion to arbitrary directory trees. The attack requires the customer to plant the symlink between task insertion and cron execution. Fixed in Froxlor 2.3.12.
Affected products
- Froxlor Froxlor through 2.3.10
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 2.3.12