Froxlor Cleanup Can Erase Unrelated Files
An authenticated tenant with a writable FTP home can insert a symlink after account deletion is queued but before its root cron worker runs. CVE-2026-100715 redirects recursive cleanup beyond assigned storage, threatening neighbouring data and host availability. The vendor disclosure describes links in intermediate or final components; an appended slash enables the latter case. Text checks do not establish containment when execution begins.
The advisory lists releases through 2.3.10 as affected and 2.3.12 as fixed. The index repeats that ceiling in prose but covers all earlier builds in structured data. That mismatch does not clear the intermediate version. The disclosure supplies reproduction details, not a malicious-campaign report.
Review cleanup authority
The NCSC’s general response guidance covers logs, segregated backups and recovery verification. Applying those methods here requires mapping customer requests to privileged background tasks and the storage each can reach, including retention and account offboarding.
Test tenant recovery separately from whole-server recovery. Record timings and authorisers, so an outage response follows evidence rather than urgency.
- Install the corrected release or later.
- Prioritise hosts where tenants share an operating system and privileged scheduler.
- Correlate queued and recent FTP deletions with scheduler logs, filesystem changes and service failures.
- Inspect such home-directory links targeting other storage, especially near deletion events.
- Keep recovery copies beyond both customers’ and panel tasks’ deletion or rewrite authority.
- Combine separate storage and least-privileged helpers with mount separation. The manual describes different mount views; this alone is not a complete security boundary.
With a benign test tenant, verify that legitimate cleanup succeeds while other tenants’ storage remains unreachable. Use no real customer data or destructive production paths.
Our earlier cPanel report follows file creation and code execution, a different route into privileged hosting automation.
Sources and chronology
Rechecked 26 October 2026. The advisory’s publication timestamp is 6 September 2026, 09:59:39 UTC; no separate public update time is exposed. The fixed-release record is dated 23 August 2026, 12:39:28 UTC. The NVD entry was published on 26 September 2026 at 14:16:57 UTC.
The response guide was reviewed on 19 September 2019; the Linux manual is dated 8 February 2026. These are general methods, not investigations of this incident.
