Froxlor up to version 2.3.10 is vulnerable to arbitrary file deletion due to symlink following in the FTP data deletion cron task. Specifically, when an FTP account is deleted, a cron task runs as root and calls FileDir::makeCorrectDir() without the $fixed_homedir argument, skipping symlink component checks. The task then executes 'rm -rf' on the resulting path, which includes a trailing slash causing GNU rm to dereference symlinks. An authenticated user able to write to the FTP home directory can plant a symlink between task scheduling and execution, causing the root cron job to delete arbitrary directories recursively. This leads to cross-tenant data destruction and host denial of service. The vulnerability is fixed in Froxlor 2.3.12.

An authenticated user with write access to the FTP home directory can exploit this vulnerability to cause arbitrary recursive deletion of files and directories on the host system with root privileges. This can result in destruction of data belonging to other tenants and denial of service of the host system. The vulnerability does not impact confidentiality but has high integrity and availability impacts.

Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. Until then, restrict write access to FTP home directories to trusted users only. No other official mitigations are documented.