CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-100715 — Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink foll...

·Source: NIST NVD

Updated:

Executive Summary

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because mak

Analysis

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12. CVSS Score: 9.6. Published: 2026-09-26T14:16:57.427.

Indicators of Compromise (1)

CVE (1)
CVE-2026-100715
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 26, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

YouTuber raises $15m for Brazil's 'Cash App'

NG.Cash, the "Brazilian Cash App" founded by a former YouTuber, has raised $15 million to back its efforts to bring credit and crypto services to the country's young, unbanked population.

Finextra
MEDIUMVulnerability

Unidentified Flock Cameras in Florida

St. Lucie County in Florida discovered ( alt link ) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case

Schneier on Security
CRITICALVulnerability

NVD CRITICAL: CVE-2026-19652 — The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation i...

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowe

CVE-2026-19652
NIST NVD