Froxlor versions prior to 2.2.0 generate the database configuration file /etc/pure‑ftpd/db/mysql.conf with permissions 0644 while the file contains the MySQL user password set by Froxlor. A local user who can execute code on the host, including virtual FTP users who can upload PHP or CGI scripts, can read this file. With the database credentials the attacker can connect to the Froxlor database, alter an administrator’s password hash and TOTP seed, log in as an administrator, and eventually gain root privileges. This behavior is an example of the CWE‑732 weakness of insecure file permissions. The impact is therefore a complete escalation of privileges from an unprivileged local user to the root user.

Froxlor installations older than 2.2.0, including release candidates up to 2.2.0‑rc3, are affected when the system is configured to use pure‑ftpd. The vulnerability is present on systems that have the default Debian 12 directory permissions, where parent directories of /etc/pure‑ftpd/db are world readable. Only Froxlor deployments using pure‑ftpd are impacted; other FTP backends are not affected.

The CVSS score of 8.4 assigns this vulnerability a high severity rating. EPSS data is not available, but the lack of a remote component means that exploitation requires a local, unprivileged user and can be carried out if that user can run code on the host, which is common in shared hosting scenarios. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, and the exploitation path involves reading a file with sensitive credentials, connecting to a database without additional authentication, and performing privileged database operations.