CVE-2026-100715

Executive Summary

CVE-2026-100715 is a high-severity symlink-following vulnerability in Froxlor through 2.3.10 that allows an authenticated customer to cause arbitrary file and directory deletion executed as root. The flaw resides in cron task 8 (deleteFtpData), which invokes FileDir::makeCorrectDir() without the $fixed_homedir argument and then runs rm -rf on the resulting path using only string-level guards. Successful exploitation results in cross-tenant data destruction and host-level denial of service. The vulnerability is fixed in Froxlor 2.3.12 and, as of this report, has no public proof-of-concept, no Nuclei template, and is not listed in CISA KEV.

Technical Analysis

Froxlor is a web-based server management control panel used to administer hosting environments, including customer accounts, domains, mail, and FTP services. The vulnerable component is a scheduled cron task, identified as task 8 (deleteFtpData), which is queued when an FTP account is deleted.

The vulnerability mechanism is classic symlink following (CWE-59) combined with insufficient path validation prior to a privileged recursive delete:

1. When an FTP account is deleted, cron task 8 (deleteFtpData) is inserted into the queue.
2. At execution time, the task calls FileDir::makeCorrectDir() without supplying the $fixed_homedir argument.
3. Because $fixed_homedir is omitted, the symlink component walk that would normally resolve and validate path components is skipped.
4. The task then executes rm -rf as root on the resulting path, protected only by string-level guards.
5. makeCorrectDir() appends a trailing slash to the returned path. GNU rm treats a path with a trailing slash as a directory and will dereference a symlink whether it appears as an intermediate path component or as the final component.

This behavior is central to the vulnerability: trailing-slash handling in GNU coreutils rm causes the tool to follow the symlink rather than operate on the link itself. A string-level guard cannot reliably detect this, because the dangerous behavior occurs at filesystem resolution time, not at string comparison time.

The attack surface is authenticated: the attacker must be a customer with write access to their FTP home directory. The exploitable window exists between the time the deletion task is queued and the time the root cron job executes. Within that window, the attacker plants a symlink in the FTP home directory pointing to a target directory tree. When the privileged cron task runs, rm -rf follows the symlink and recursively deletes the target.

No public proof-of-concept, exploit code, or Nuclei template is available. Function and class names referenced here (FileDir::makeCorrectDir(), the $fixed_homedir argument, cron task 8 deleteFtpData) are drawn verbatim from the NVD description. No further implementation-level detail (additional helper functions, internal code paths, or parameter names) is available and none should be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-59 symlink following in a privileged process) and from the details given in the NVD description.

1. Reconnaissance / target identification. The attacker obtains or already holds a valid customer account on a Froxlor-hosted system, with the ability to create and manage FTP accounts and to write files within the FTP home directory. The attacker identifies the Froxlor version (through 2.3.10) and understands that FTP account deletion triggers cron task 8 (deleteFtpData).

2. Setup and trigger. The attacker creates or uses an FTP account associated with their tenant. They ensure they can write to the FTP home directory.

3. Payload placement (vulnerability-class level). The attacker plants a symlink in the FTP home directory that points to a target directory tree they wish to destroy. Because makeCorrectDir() appends a trailing slash and GNU rm dereferences symlinks in that condition, the symlink can be used either as an intermediate path component or as the final component. The attacker must complete this placement before the cron task executes, i.e., between task insertion and cron execution.

4. Trigger. The attacker deletes the FTP account, queuing cron task 8 (deleteFtpData).

5. Privileged execution. The cron task calls FileDir::makeCorrectDir() without $fixed_homedir, skips the symlink component walk, and runs rm -rf as root on the resulting path. The string-level guards do not prevent the following of the planted symlink.

6. Post-exploitation impact. rm -rf as root recursively deletes the directory tree targeted by the symlink. Because the target can be outside the attacker's tenant, the result is cross-tenant data destruction and host denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) reflects network-reachable exploitation requiring only low privileges, no user interaction, a scope change, no confidentiality impact, high integrity impact, and high availability impact — consistent with destructive deletion rather than data exfiltration.

Impact Assessment

The CVSS 3.1 base score is 9.6 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H.

• Attack Vector (Network): exploitation is performed over the network via the Froxlor interface.
• Attack Complexity (Low): no specialized conditions beyond timing the symlink placement within the cron window are required.
• Privileges Required (Low): an authenticated customer account with FTP management and FTP home directory write access is sufficient.
• User Interaction (None): no victim action is required; the root cron job executes automatically.
• Scope (Changed): the attacker's actions within their own tenant affect components and data belonging to other tenants and the host, crossing a security boundary.
• Confidentiality (None): the flaw is destructive, not exfiltrative.
• Integrity (High): arbitrary directory trees can be destroyed.
• Availability (High): recursive deletion of system or tenant data can render the host or its hosted services unavailable.

Blast radius: the deletion executes as root, so any directory tree reachable via the planted symlink is at risk. On multi-tenant Froxlor deployments, this enables an authenticated tenant to destroy another tenant's data, and potentially host-level directories, producing denial of service for all co-hosted customers. Recovery may require restoration from backups, and any data without backups is permanently lost.

Detection Guidance

Sigma Rule

title: Suspicious Root-Context Recursive Deletion via Froxlor FTP Data Cron
id: 6b1f3a90-2c4d-4e77-9a1b-7d5e2f8c1007
status: experimental
description: Detects rm -rf execution by root in the context of Froxlor cron task deleteFtpData that may result from symlink following (CVE-2026-100715), including deletion of paths outside expected FTP home directories.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100715
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_exec:
    type: 'EXECVE'
    a0|endswith: '/rm'
  selection_args:
    a1: '-rf'
  selection_parent:
    exe|contains: 'froxlor'
  selection_symlink:
    type: 'SYSCALL'
    syscall|contains: 'symlink'
  timeframe: 15m
  condition: (selection_exec and selection_args and selection_parent) or selection_symlink
falsepositives:
  - Legitimate Froxlor administrative cleanup of FTP directories
  - System maintenance scripts deleting cache or temporary directories
level: high
tags:
  - attack.t1485
  - cve.2026.100715

YARA Rule

rule CVE_2026_100715_Froxlor_Symlink_Delete
{
    meta:
        description = "Detects Froxlor PHP source indicative of the vulnerable deleteFtpData cron path lacking fixed_homedir (CVE-2026-100715)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100715"
        severity = "high"

    strings:
        $s1 = "deleteFtpData" ascii
        $s2 = "makeCorrectDir" ascii
        $s3 = "fixed_homedir" ascii
        $s4 = "rm -rf" ascii
        $s5 = "FileDir::makeCorrectDir" ascii

    condition:
        uint32be(0) == 0x3C3F7068 and
        (
            (any of ($s1, $s4)) and any of ($s2, $s3, $s5)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100715 Froxlor FTP Account Deletion Triggering Privileged Delete Task"; flow:established,to_server; content:"POST"; http_method; content:"ftp"; http_uri; nocase; content:"delete"; http_uri; nocase; reference:cve,2026-100715; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100715; classtype:attempted-admin; sid:2026100715; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, affected_product Froxlor, cve CVE_2026_100715;)

Elastic Detection

process where host.os.type == "linux" and event.type == "start" and
process.name == "rm" and
process.args : "-rf*" and
process.parent.name : ("cron" or "crond") and
process.parent.command_line : "*deleteFtpData*"

Splunk SPL Query

index=linux sourcetype=auditd (type=EXECVE AND (a0="*/rm" OR a0="rm") AND (a1="-rf" OR a1="-fr"))
| eval full_cmd = mvjoin(mvappend(a0,a1,a2,a3), " ")
| where match(full_cmd, "deleteFtpData") OR match(full_cmd, "froxlor")
| stats count min(_time) as first_seen max(_time) as last_seen values(full_cmd) as commands by host, uid
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="linux,froxlor,cve-2026-100715,">
  <rule id="100715" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.execve.a0">rm</field>
    <field name="audit.execve.a1">-rf</field>
    <match>deleteFtpData|froxlor</match>
    <description>CVE-2026-100715: Froxlor deleteFtpData cron executed rm -rf as root - possible symlink-following arbitrary deletion.</description>
    <mitre>
      <id>T1485</id>
    </mitre>
    <group>cve_2026_100715,data_destruction,</group>
  </rule>
  <rule id="100716" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.syscall">symlink</field>
    <match>ftp</match>
    <description>CVE-2026-100715: Suspicious symlink creation in FTP home directory preceding privileged deletion.</description>
    <mitre>
      <id>T1485</id>
    </mitre>
    <group>cve_2026_100715,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description states the issue is fixed in Froxlor 2.3.12, no patch source, vendor advisory, or commit reference is available in the tracked data; treat this as unverified and validate independently.

1. Immediate mitigations

   • Upgrade Froxlor to 2.3.12 or later as the primary remediation; where upgrade is not immediately possible, coordinate validation of the 2.3.12 fix independently.
   • Restrict FTP home directory write permissions so that untrusted customers cannot create arbitrary symlinks, and disable symlink-following where the underlying platform allows it.
   • Constrain the impact of the privileged delete by running the Froxlor cron tasks under a dedicated, non-root service account with access limited to the affected tenants' directories instead of root.
   • Harden rm behavior by avoiding trailing-slash construction of paths prior to deletion and preferring safer in-process deletion routines that do not dereference symlinks.
   • Maintain offline, immutable backups of tenant and host data so destructive changes are recoverable.

2. Patch / upgrade steps

   • Verify the installed Froxlor version; anything through 2.3.10 is affected.
   • Upgrade to Froxlor 2.3.12 or later following the project's standard upgrade procedure.
   • After upgrading, confirm that FileDir::makeCorrectDir() is called with the $fixed_homedir argument in the deleteFtpData cron path and that the symlink component walk is no longer skipped.
   • Re-validate that cron task 8 no longer follows planted symlinks, and confirm the rm -rf invocation is scoped to the correct home directory.

3. Long-term hardening

   • Adopt least-privilege execution for all control-panel cron jobs; avoid running destructive operations as root.
   • Enforce canonical path resolution and reject symlinks during any privileged recursive deletion.
   • Monitor audit logs for root-context rm -rf executions and symlink creation in FTP home directories.
   • Track Froxlor security advisories and subscribe to CVE feeds to respond promptly to future control-panel vulnerabilities.

References

• NVD — CVE-2026-100715: https://nvd.nist.gov/vuln/detail/CVE-2026-100715
• CWE-59: Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
• Froxlor project website and release notes (verify 2.3.12 fix): https://froxlor.org
• MITRE ATT&CK T1485 — Data Destruction: https://attack.mitre.org/techniques/T1485/
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/

No CISA KEV listing exists for this CVE, and no public proof-of-concept, exploit code, or known threat actor campaign has been observed.