GHSA-75h4-c557-j89r

## Summary `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes `chown -R` on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. ## Details The vulnerability is an incomplete patch. After CVE-2023-6069, symlink validation was added to `FileDir::makeCorrectDir()` via a `$fixed_homedir` parameter. When provided, it walks each path component checking for symlinks that escape the customer's home directory (lines 134-157 of `lib/Froxlor/FileDir.php`). Every customer-facing API command that builds a path from user input passes this parameter: ```php // DirProtections.php:87 $path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']); // DirOptions.php:96 $path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']); // Ftps.php:178 $path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']); // SubDomains.php:585 return FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']); ``` But `DataDump.add()` was missed: ```php // DataDump.php:88 — NO $fixed_homedir parameter $path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path); ``` The path flows unvalidated into a cron task (`lib/Froxlor/Api/Commands/DataDump.php:133`): ```php Cronjob::inserttask(TaskId::CREATE_CUSTOMER_DATADUMP, $task_data); ``` When `ExportCron::handle()` runs as root, it executes at `lib/Froxlor/Cron/System/ExportCron.php:232`: ```php FileDir::safe_exec('chown -R ' . (int)$data['uid'] . ':' . (int)$data['gid'] . ' ' . escapeshellarg($data['destdir'])); ``` The `chown -R` command follows sy