In Froxlor versions 2.3.10 and earlier, the DataDump cron job fails to properly validate intermediate path components of the export destination due to an off-by-one error in Froxlor\FileDir::makeCorrectDir() and insufficient checks in ExportCron.php. An authenticated customer with export privileges can schedule an export into a subdirectory of their webspace, then replace an intermediate path component with a symlink. When the root-owned cron runs, it performs a recursive chown on the linked directory tree, potentially changing ownership of critical system directories such as /etc to the customer's UID. This vulnerability allows deterministic exploitation without race conditions and can result in host root and cross-tenant compromise. The vulnerability is identified as CVE-2026-100716 and is fixed in Froxlor 2.3.12.

Successful exploitation allows an authenticated customer to escalate privileges by causing the root-owned cron job to recursively change ownership of arbitrary directories, including sensitive system directories. This leads to full host root compromise and cross-tenant security breaches. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability.

Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the root cause of the path validation and symlink handling issues.