Executive brief
Froxlor is an open-source server management platform used to administer web hosting environments. A security flaw in how the system synchronizes SSH keys allows a customer with basic account access to trick the system into granting them full administrative (root) control over the entire server. This could lead to total data exposure, service disruption, and unauthorized access to all other customer accounts on the same machine.
Technical details
A symlink-following vulnerability (CWE-59) exists in Froxlor 2.3.6 within the root-owned SSH key synchronization logic. The application appends public keys to `~/.ssh/authorized_keys` in customer-controlled home directories without verifying if the path is a symbolic link. An authenticated attacker with shell-enabled customer access can replace their `authorized_keys` file with a symlink pointing to `/root/.ssh/authorized_keys`. When the privileged cron task runs the `REBUILD_NSSUSERS` task, it follows the link and appends the attacker's public key to the root user's authorized keys file, granting the attacker full root SSH access. This issue is resolved in version 2.3.7.
Affected products
- Froxlor Froxlor 2.3.6
Timeline
- 2026-05-15: patched: Version 2.3.7 released
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: CVE published to NVD