Vulnerability in Froxlor
CVE-2026-113678
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv (vendor-advisory)
- github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8 (patch)
- github.com/froxlor/froxlor/releases/tag/2.3.15 (release-notes)
- github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Http/Statistics.php (technical-description)
- www.vulncheck.com/advisories/froxlor-before-2.3.15-symlink-following-privilege-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-113678?
- CVE-2026-113678 is a critical-severity vulnerability in Froxlor, classified under Improper Link Resolution Before File Access. CVSS score: 9.9/10. Published 2026-10-20.
- How severe is CVE-2026-113678?
- Critical severity. CVSS v3 base score is 9.9 out of 10.