The vulnerability resides in Froxlor versions 2.3.10 and earlier, where the DataDump export cron does not properly validate intermediate path components of the export destination. An off‑by‑one error in Froxlor’s path walk skips the first segment below the customer home directory, and the final guard only checks the last component for a symlink. An authenticated customer whose export feature is enabled can schedule an export into a legitimate subdirectory of their webspace, then replace an intermediate path component with a symlink pointing to a protected directory such as /etc. When the root‑owned cron runs, it executes a recursive chown, changing ownership of the symlinked directory tree to the customer’s UID. This yields system root or cross‑tenant compromise. The flaw is deterministic and requires no race conditions, making the attack straightforward once the vulnerability is known.

Froxlor, a server administration panel, versions 2.3.10 and earlier, including any earlier releases, are affected. The product is an open‑source application that runs on typical Linux web hosting environments. Users running these versions should verify that export functionality is available to customers.

The high CVSS score underscores that an exploited instance grants root or privileged access to the underlying operating system, enabling full system compromise. Because the exploit path is direct and does not rely on race conditions or shellcode, a malicious user can repeat the attack without special conditions, making it reproducible. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the deterministic nature and broad user base make it a concerning risk for affected installations.