Live › vulnerability › CVE-2026-113678
Go to dashboardFroxlor 2.0.0 through 2.3.14: Statistics::makeChownWithNewStats runs 'chown -R' as root on <documentroot>/<traffictool>/ (default goaccess) without symlink containment. A customer replaces that entry with a symlink to any host directory such as /etc/ssl/private. The daily root traffic cron, enabled by default, then gives the customer ownership of that directory. That exposes TLS keys and lets them write Apache config, which leads to root. The advisory includes a PoC. It needs an authenticated customer account with access to their own docroot (shell, FTP or web).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| froxlor | composer | >= 2.0.0, <= 2.3.14 | 2.3.15 |
php /var/www/froxlor/bin/froxlor-cli --version, or read the footer or version of the Froxlor admin UI2.0.0 to 2.3.14 is affectedtraffic job in the panel's cron settings and check for symlinks that point outside the customers directory2.3.15 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
This page as .md · .json · in your agent: get_signal("CVE-2026-113678")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.