The installer uses static/predictable tmp files. Line numbers are from current git master, but it's also present in froxlor in Factory

  the code is in lib/class.FroxlorInstall.php
  341                 } elseif ($fp = @fopen('/tmp/userdata.inc.php', 'w')) {
  342                         $result = @fputs($fp, $userdata, strlen($userdata));
  343                         @fclose($fp);
  344                         $content .= $this->_status_message('orange', $this->_lng['install']['creating_configfile_temp']);
  345                         chmod('/tmp/userdata.inc.php', 0440);
  <snip>
  719                         // create temporary backup-filename
  720                         $filename = "/tmp/froxlor_backup_" . date('YmdHi') . ".sql";

  Local users can use this to cause DoS or corrupt files owned by the user
  running the webserver.