Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Description

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12.

Scores

EPSS (exploitation in 30 days)

0.46% · top 60% of all CVEs (4 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.5.

Weakness

• CWE-59: Improper Link Resolution Before File Access ('Link Following') (opens in a new tab)All about CWE-59 and its CVEs

Affected products

• froxlor · froxlor

  • affected < 2.3.12
  • unaffected 2.3.12

References (2)

• GitHub Security Advisory (GHSA-px4q-2rf7-cvcf) (opens in a new tab)vendor-advisoryexploit
• VulnCheck Advisory: Froxlor before 2.3.12 Arbitrary File Deletion via Symlink (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-100715](https://trackcve.app/badge/CVE-2026-100715.svg)](https://trackcve.app/cve/CVE-2026-100715)

Record last updated 28 Sept 2026, 16:59 UTC.