The flaw is a time‑of‑check time‑of‑use (TOCTOU) race condition (CWE-367) in the SSH key synchronization routine of Froxlor 2.3.10 and earlier. During each cron run the system builds the target directory and file path, verifies no forbidden symlinks exist, then writes the customer’s public key to the target file. Because the validation is performed only once, an attacker can atomically replace their local ~/.ssh directory with a symlink to a privileged file such as /root/.ssh/authorized_keys before the file write occurs. The cron, running as root, then appends the attacker’s key to that file and changes its ownership to the attacker, giving the customer full root capabilities on the hosting machine.

All deployments of the Froxlor control panel using version 2.3.10, 2.3.11 or earlier that have the system.allow_customer_shell setting enabled. The vulnerability is fixed starting with Froxlor 2.3.12.

The risk rating is CVSS 7.1, the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue. The exploitation path relies on local cooperation by a customer who can flip the symlink during the window between the check and the write, and the cron is scheduled to run repeatedly, enabling repeated attempts. Once the race is won, the attacker can append their key to root’s authorized_keys and take unchecked root access.