{"id":"CVE-2026-113678","kind":"vulnerability","aliases":["CVE-2026-113678"],"related":[],"title":"Froxlor hosting panel: symlink flaw lets customers take root-owned directories","description":"Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.","summary":"Froxlor 2.0.0 through 2.3.14: Statistics::makeChownWithNewStats runs 'chown -R' as root on <documentroot>/<traffictool>/ (default goaccess) without symlink containment. A customer replaces that entry with a symlink to any host directory such as /etc/ssl/private. The daily root traffic cron, enabled by default, then gives the customer ownership of that directory. That exposes TLS keys and lets them write Apache config, which leads to root. The advisory includes a PoC. It needs an authenticated customer account with access to their own docroot (shell, FTP or web).","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"froxlor","fixed":["2.3.15"],"affected":">= 2.0.0, <= 2.3.14","ecosystem":"composer"}],"ecosystems":[],"tags":["cron","froxlor","other","privilege-escalation","self-hosted","shared-hosting","symlink"],"not_affected_if":["managed-hosting","no-untrusted-customers","single-tenant","version-2.3.15-or-later"],"how_to_check":"Check the version: run 'php /var/www/froxlor/bin/froxlor-cli --version', or read the footer or version of the Froxlor admin UI. Any version from 2.0.0 to 2.3.14 is affected. The traffic cron is active by default: look for the froxlor cron entry in /etc/cron.d and the 'traffic' job in the panel's cron settings. To look for abuse, run 'find /var/customers/webs -maxdepth 2 -type l -name goaccess -o -type l -name awstats -o -type l -name webalizer' and check for symlinks that point outside the customer's directory. Also look for unexpected ownership changes on system directories such as /etc/ssl/private.","fix":"Upgrade Froxlor to 2.3.15 or later. Until then, disable the traffic cron job or stop untrusted customers from using shell, FTP or web access to their docroot. If you suspect abuse, check ownership of system directories and rotate the TLS keys and any secrets that were exposed.","status":"open","published_at":"2026-10-20T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:28+00:00","updated_at":"2026-10-23T23:20:18+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:39:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Froxlor to 2.3.15 or later.","reach":"local","title":"Froxlor hosting panel: symlink flaw lets customers take root-owned directories","impact":"high","summary":"Froxlor before 2.3.15 has a symlink-following bug in its statistics code that runs as root from a cron job. An authenticated customer can replace the statistics directory in their web root with a symlink, so the root cron recursively chowns chosen host directories to them, enabling privilege escalation to root.","category":"other","who_cares":["froxlor","self-hosted","shared-hosting"],"confidence":0.7,"needs_auth":"yes","worst_case":"Customer gains root on the host by taking ownership of system directories","analyst_note":"Confirm the exact affected versions and whether the traffic cron is enabled by default; check the Froxlor advisory linked from the NVD entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","version-2.3.15-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000493,"input_tokens":2968,"output_tokens":392,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact affected versions and whether the traffic cron is enabled by default; check the Froxlor advisory linked from the NVD entry.","search":"'-113678':15A,18A '-2026':14A,17A '/etc/ssl/private':64B '2.0.0':34B '2.3.14':36B '2.3.15':118C 'abus':139C 'access':107B 'account':105B 'advisori':96B 'allow':128C 'apach':89B 'arbitrari':135C 'attack':146C 'authent':103B,129C 'caus':160C 'chown':40B,161C 'config':90B 'contain':49B,119C 'cron':20B,69B,145C 'custom':7A,51B,76B,104B,130C 'cve':13A,16A 'daili':66B 'default':45B,72B 'directori':12A,61B,80B,137C,152C 'docroot':111B 'document':155C 'enabl':70B,172C 'entri':54B 'escal':25B,174C 'expos':82B 'flaw':5A 'follow':122C 'froxlor':1A,19A,21B,33B,116C 'ftp':113B 'give':74B 'goaccess':46B,150C 'hand':164C 'host':2A,28B,31B,60B,136C 'includ':97B 'key':84B 'lead':92B 'let':6A,86B 'makechownwithnewstat':38B,126C 'need':101B 'own':11A,167C 'ownership':77B,133C 'panel':3A 'poc':99B 'privileg':24B 'privilege-escal':23B 'r':41B,162C 'replac':52B,148C 'root':10A,43B,67B,94B,142C,156C,166C,173C 'root-own':9A,165C 'root-run':141C 'run':39B,143C 'self':27B 'self-host':26B 'share':30B 'shared-host':29B 'shell':112B 'statist':37B,125C,151C 'symlink':4A,32B,48B,57B,121C,159C 'take':8A,132C 'tls':83B 'traffic':68B,144C 'tree':168C 'vulner':123C 'web':115B 'without':47B 'write':88B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113678","severity":null,"published_at":"2026-10-20T16:17:12+00:00","modified_at":"2026-10-23T02:16:56+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113678:418","url":null,"severity":null,"published_at":"2026-10-23T23:20:18+00:00","modified_at":"2026-10-23T23:20:18+00:00","first_seen_at":"2026-10-23T23:20:18+00:00","fetched_at":"2026-10-23T23:20:18+00:00","note":"Read the Froxlor GHSA-vwjv-x8ff-4cvv, the 2.3.15 release notes and fix commit 0805a7e. Affected is >=2.0.0, <=2.3.14. The traffic cron is seeded active by default and runs as root. The advisory includes a working PoC (in the advisory text, not a separate repo). No exploitation in the wild is reported. I did not search social posts: the product is niche. Severity is disputed: GHSA says Moderate/High (CVSS v3.1 8.8, AV:L), VulnCheck says 9.4 (CVSS v4) and OpenCVE says 9.9. I left severity unchanged."}],"documents":[{"id":1893,"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv","title":"GHSA-vwjv-x8ff-4cvv: symlink containment in root traffic cron chown -R","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1894,"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","title":"froxlor bugfix release 2.3.15","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1895,"url":"https://github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8","title":"Fix commit 0805a7e","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1896,"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.15-symlink-following-privilege-escalation-via-traffic-cron","title":"VulnCheck advisory, CVSS v4 9.4","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}