CVE-2026-100716

Executive Summary

CVE-2026-100716 is a high-severity link-following vulnerability in Froxlor, a server administration panel, affecting versions 2.3.10 and earlier. An authenticated customer with the data-export (DataDump) feature enabled can exploit an off-by-one flaw in path-component handling to escalate privileges to host root and compromise other tenants. The flaw allows a scheduled export cron job running as root to recursively change ownership of arbitrary directory trees via a symlink, resulting in full system compromise. The issue is fixed in Froxlor 2.3.12, but no patch confidence is currently recorded from tracked sources.

Technical Analysis

Froxlor is a web-based server management panel. The vulnerability resides in the customer data-export (DataDump) cron functionality. Specifically, Froxlor\FileDir::makeCorrectDir() contains an off-by-one error in its path-component walk that skips the first segment below the customer home directory. Additionally, the guard in ExportCron.php checks only the final component with is_link(), failing to validate intermediate path components of the export destination.

An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace. Before the root-owned cron runs, the customer can replace an intermediate path component with a symlink. When the cron executes, its chown -R command recursively changes ownership of the linked directory tree — for example, /etc — to the customer's UID. This yields host root and cross-tenant compromise. The exploitation is deterministic and requires no race condition. This is an incomplete fix of GHSA-75h4-... (advisory ID partially redacted). The issue is fixed in Froxlor 2.3.12.

The attack surface is the authenticated customer interface where export scheduling is configured. The flaw class is CWE-59: Improper Link Resolution Before File Access ('Link Following'). The CVSS vector indicates network exploitable, low privileges required, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance/target identification: The attacker identifies a Froxlor instance (versions <= 2.3.10) and obtains valid customer credentials with the data-export feature enabled. This could be through legitimate account creation, compromised credentials, or phishing.

2. Triggering the flaw class: The attacker schedules a data export into a genuine subdirectory of their own webspace. Leveraging the off-by-one in makeCorrectDir() and the insufficient is_link() check in ExportCron.php, the attacker replaces an intermediate path component (not the final component) with a symlink pointing to a target directory such as /etc. Because the guard only checks the final component, the symlink is not detected.

3. Payload/execution method: When the root-owned cron job runs, it executes chown -R on the export destination path. Due to the symlink, this recursively changes ownership of the linked directory tree (e.g., /etc) to the customer's UID. No race condition is required; the symlink is placed before the cron executes.

4. Post-exploitation impact: The attacker gains ownership of critical system directories, enabling privilege escalation to root (e.g., by modifying /etc/passwd, /etc/shadow, or cron jobs) and cross-tenant compromise. This leads to full host compromise, data theft, service disruption, and lateral movement within the hosting environment.

Impact Assessment

The CVSS score is 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This reflects network exploitability, low privileges required (authenticated customer), no user interaction, changed scope (impact extends beyond the vulnerable component to the host OS), and high impact on confidentiality, integrity, and availability.

Business impact: A malicious customer or an attacker with customer-level access can escalate to root on the host, compromising all hosted tenants and the underlying server. This can lead to data breaches, ransomware deployment, service outages, and reputational damage. The blast radius includes the entire Froxlor-managed server and all customer accounts. Since exploitation is deterministic and requires no race, it is highly reliable and could be automated.

Detection Guidance

Sigma Rule

title: Suspicious Symlink Creation in Froxlor Export Paths
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects creation of symlinks in intermediate path components of Froxlor export destinations, potentially exploiting CVE-2026-100716.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: file_event
  product: linux
detection:
  selection:
    EventType: 'symlink'
    TargetFilename|contains: '/var/customers/webs/'
  condition: selection
falsepositives:
  - Legitimate administrative symlink creation
level: high
tags:
  - attack.privilege_escalation
  - cve.2026-100716

YARA Rule

rule CVE_2026_100716_Froxlor_Symlink_Exploit
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-100716 in Froxlor via symlink creation in export paths"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100716"
        severity = "critical"
    strings:
        $s1 = "makeCorrectDir" ascii wide nocase
        $s2 = "ExportCron" ascii wide nocase
        $s3 = "DataDump" ascii wide nocase
        $s4 = "is_link" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-100716 Froxlor DataDump Export Symlink Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/froxlor/"; http_uri; content:"action="; http_client_body; content:"export"; http_client_body; content:"datadump"; http_client_body; reference:cve,2026-100716; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100716; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

file where event.type == "creation" and file.path : "/var/customers/webs/*" and file.symlink_target != null

Splunk SPL Query

index=linux sourcetype=auditd type=SYMLINK OR (type=SYSCALL comm="ln" AND exe="/bin/ln")
| where match(path, "/var/customers/webs/")
| stats count values(path) as paths by host, user
| where count > 0

Wazuh OSSEC Rule

<group name="froxlor,cve-2026-100716,">
  <rule id="100001" level="12">
    <if_sid>550</if_sid>
    <field name="file">/var/customers/webs/</field>
    <match>symlink</match>
    <description>CVE-2026-100716: Suspicious symlink creation in Froxlor export path detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable the data-export (DataDump) feature for all customer accounts until the patch is applied.
   • Restrict cron execution or run the export cron with least privilege (non-root) if feasible.
   • Monitor for symlink creation in webspace directories and alert on suspicious activity.
   • Apply file integrity monitoring on critical directories like /etc.

2. Patch/upgrade steps:

   • Upgrade to Froxlor 2.3.12 or later, which fixes this issue.
   • Verify the upgrade and confirm the export cron behavior no longer follows symlinks in intermediate path components.
   • Since patch confidence is 0/4, validate the fix independently and monitor vendor channels for updates.

3. Long-term hardening:

   • Implement strict path validation and canonicalization for all file operations, especially those involving user-controlled paths.
   • Avoid running cron jobs as root; use dedicated service accounts with minimal privileges.
   • Use lchown or openat2 with RESOLVE_NO_SYMLINKS to prevent symlink traversal.
   • Conduct regular security audits of file handling code and employ static analysis tools.
   • Segment tenant environments to limit cross-tenant impact.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100716
• Froxlor GitHub Security Advisory (GHSA-75h4-...): https://github.com/Froxlor/Froxlor/security/advisories/GHSA-75h4-...
• Froxlor Release 2.3.12: https://github.com/Froxlor/Froxlor/releases/tag/2.3.12
• CWE-59: Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.