CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
A race condition in Froxlor's SSH key sync allows local users to escalate privileges to root if customer shell access is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100713?
CVE-2026-100713 is a high-severity vulnerability in froxlor, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APPEND|LOCK_EX, followed by chmod/chown/chgrp), with a database round-trip and file reads in between, and no path or file-descriptor pinning (no O_NOFOLLOW or openat2(RESOLVE_NO_SYMLINKS)). On installations where the non-default setting system.allow_customer_shell=1 grants customers local shell access, a customer can atomically swap their ~/.ssh directory for a symlink after the check and before the write, causing the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and to chown /root/.ssh to the customer, resulting in full root compromise of the panel host. The cron re-runs on every interval, allowing unlimited attempts. This is a residual race that bypasses the check-time fix introduced for GHSA-mq5v-... . The issue is fixed in Froxlor 2.3.12.
Weakness: CWE-367
Which versions are affected by CVE-2026-100713?
How do I fix CVE-2026-100713?
No fix has been published for CVE-2026-100713 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100713 being exploited?
There is no known exploitation of CVE-2026-100713 in the wild and no public exploit code.
Sources
Also known as GHSA-927x-9jfh-mq42, GHSA-cvg5-3xjx-32m5.