Is CVE-2026-100716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100716 being exploited in the wild.

How severe is CVE-2026-100716?

Critical severity, with a CVSS score of 9.9, published 26 September 2026.

Is there a fix for CVE-2026-100716?

A patch was published on 2026-09-26: Fixed in Froxlor 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100716 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100716?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100716: Froxlor server administration panel symlink path traversal privilege escalation

CVE-2026-100716 · Severity: critical · CVSS 9.9 · Published 2026-09-26

Froxlor is a server administration panel for hosting management. A flaw in its customer data-export feature allows authenticated customers to trick the root-owned cron job into changing ownership of arbitrary system directories—such as /etc—to their user account. An attacker can gain complete control of the server and access other customers' data through this deterministic exploit that requires no race conditions.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-100716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100716 being exploited in the wild.
How severe is CVE-2026-100716?: Critical severity, with a CVSS score of 9.9, published 26 September 2026.
Which products and versions are affected?: Froxlor 2.3.10 and earlier.
Is there a fix for CVE-2026-100716?: A patch was published on 2026-09-26: Fixed in Froxlor 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100716 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100716?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from two compounding defects: an off-by-one error in FileDir::makeCorrectDir() that skips symlink validation of the first path segment below the customer's home directory, and an incomplete guard in ExportCron.php that checks only the final path component with is_link(). An authenticated customer with export privileges can schedule an export to a genuine subdirectory, then replace an intermediate path component with a symlink before the root cron executes, causing chown -R to recursively transfer ownership of the linked directory tree to the customer's UID.

Affected products

Froxlor Froxlor 2.3.10 and earlier

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in Froxlor 2.3.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.