{"id":29796,"date":"2026-09-27T00:31:42","date_gmt":"2026-09-26T16:31:42","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100716"},"modified":"2026-09-27T00:31:42","modified_gmt":"2026-09-26T16:31:42","slug":"cve-2026-100716","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100716","title":{"rendered":"CVE-2026-100716 [CRITICAL] &#8211; Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer dat"},"content":{"rendered":"<p>Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: FroxlorFileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component with is_link(). An authenticated customer whose account has the export feature enabled can schedule an export into a genuine subdirectory of their own webspace, then replace an intermediate path component with a symlink before the root-owned cron runs. The cron&#8217;s `chown -R` then recursively changes ownership of the linked directory tree \u2014 for example \/etc \u2014 to the customer&#8217;s UID, yielding host root and cross-tenant compromise. Exploitation is deterministic and requires no race. This is an incomplete fix of GHSA-75h4-&#8230; The issue is fixed in Froxlor 2.3.12.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: FroxlorFil<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29796","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}