Froxlor versions through 2.3.10 contain an issue in the FTP data deletion cron task. The task, invoked when an FTP account is removed, calls a file‑path normalization function without a required argument, causing the internal symlink check to be bypassed. Because the path is appended with a trailing slash, the GNU rm utility follows symlinks, enabling an authenticated user with write access to the FTP home directory to plant a symlink that points to an arbitrary location. When the root‑owned cron job later executes 'rm -rf', it follows the symlink and recursively deletes the target directory, potentially destroying data owned by other tenants and disrupting the host service.

This flaw affects the Froxlor application from the vendor froxlor, specifically all releases before 2.3.12, including 2.3.10. Users running these versions may be exposed if they allow FTP accounts to write into their home directories and rely on the default cron task for account cleanup.

The CVSS score of 8.5 indicates a high‑severity vulnerability. The EPSS score is not reported, but the lack of a KEV listing suggests that mass exploitation has not been observed yet. Nevertheless, the flaw requires an attacker to be authenticated with sufficient write permission on the victim’s FTP home directory. Once this condition is met, the attacker can manipulate the cron job to remove any directory tree owned by the system, leading to data loss and denial of service. Given the root privileges of the cron process and the catastrophic nature of the affected operation, the risk remains high, and immediate remediation is advised.