Privilege Escalation Risk in Froxlor by Froxlor Team

CVE-2026-100713

What is CVE-2026-100713?

Froxlor versions up to 2.3.10 are susceptible to a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization process. This vulnerability allows an attacker with local shell access to exploit the cron job responsible for handling SSH keys. By replacing their home directory with a symbolic link after the initial safety check and before the actual writing occurs, an attacker can manipulate the system to append their SSH public key to the root user's authorized keys, resulting in full root access to the panel host. The flaw remains exploitable across repeated cron executions, further compounding the risk. This significant vulnerability is addressed in Froxlor version 2.3.12.

References