What’s Vulnerable › Vulnerabilities

CVE-2026-113678: Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-23
• Weakness: CWE-59

Description

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

Affected products

• froxlor: before 2.3.15 — fixed in 2.3.15

How to fix

Upgrade to a fixed version: froxlor 2.3.15. Check the vendor advisory for mitigations.

References

• https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Http/Statistics.php#L144-L162
• https://github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8
• https://github.com/froxlor/froxlor/releases/tag/2.3.15
• https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv
• https://www.vulncheck.com/advisories/froxlor-before-2.3.15-symlink-following-privilege-escalation-via-traffic-cron
• https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv

Get alerted when CVE-2026-113678 or the next vulnerability affects your stack