Threats tagged 'ghsa-x2f4-5vf2-hf4j'

Froxlor versions through 2.3.10 contain a vulnerability allowing authenticated users with write access to an FTP home directory to cause arbitrary file deletion via symlink following in a root-executed cron task. This occurs because the FTP data deletion cron job improperly handles symlinks, leading to potential cross-tenant data destruction and denial of service. The issue is resolved in Froxlor version 2.3.12.