---
id: "CVE-2026-113678"
kind: "vulnerability"
aliases: ["CVE-2026-113678"]
title: "Froxlor hosting panel: symlink flaw lets customers take root-owned directories"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "froxlor", "fixed": ["2.3.15"], "affected": ">= 2.0.0, <= 2.3.14", "ecosystem": "composer"}]
ecosystems: []
tags: ["cron", "froxlor", "other", "privilege-escalation", "self-hosted", "shared-hosting", "symlink"]
not_affected_if: ["managed-hosting", "no-untrusted-customers", "single-tenant", "version-2.3.15-or-later"]
published_at: "2026-10-20T16:17:12+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-23T23:20:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113678", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:20:18+00:00"}]
---

# Froxlor hosting panel: symlink flaw lets customers take root-owned directories

Froxlor 2.0.0 through 2.3.14: Statistics::makeChownWithNewStats runs 'chown -R' as root on <documentroot>/<traffictool>/ (default goaccess) without symlink containment. A customer replaces that entry with a symlink to any host directory such as /etc/ssl/private. The daily root traffic cron, enabled by default, then gives the customer ownership of that directory. That exposes TLS keys and lets them write Apache config, which leads to root. The advisory includes a PoC. It needs an authenticated customer account with access to their own docroot (shell, FTP or web).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:froxlor affected >= 2.0.0, <= 2.3.14 fixed 2.3.15

## How to check

Check the version: run 'php /var/www/froxlor/bin/froxlor-cli --version', or read the footer or version of the Froxlor admin UI. Any version from 2.0.0 to 2.3.14 is affected. The traffic cron is active by default: look for the froxlor cron entry in /etc/cron.d and the 'traffic' job in the panel's cron settings. To look for abuse, run 'find /var/customers/webs -maxdepth 2 -type l -name goaccess -o -type l -name awstats -o -type l -name webalizer' and check for symlinks that point outside the customer's directory. Also look for unexpected ownership changes on system directories such as /etc/ssl/private.

## Fix

Upgrade Froxlor to 2.3.15 or later. Until then, disable the traffic cron job or stop untrusted customers from using shell, FTP or web access to their docroot. If you suspect abuse, check ownership of system directories and rotate the TLS keys and any secrets that were exposed.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113678
- 2026-10-23T23:20:18+00:00 analyst — Read the Froxlor GHSA-vwjv-x8ff-4cvv, the 2.3.15 release notes and fix commit 0805a7e. Affected is >=2.0.0, <=2.3.14. The traffic cron is seeded active by default and runs as root. The advisory includes a working PoC (in the advisory text, not a separate repo). No exploitation in the wild is reported. I did not search social posts: the product is niche. Severity is disputed: GHSA says Moderate/High (CVSS v3.1 8.8, AV:L), VulnCheck says 9.4 (CVSS v4) and OpenCVE says 9.9. I left severity unchanged.

## Documents

- [advisory] GHSA-vwjv-x8ff-4cvv: symlink containment in root traffic cron chown -R https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv
- [describes] VulnCheck advisory, CVSS v4 9.4 https://www.vulncheck.com/advisories/froxlor-before-2.3.15-symlink-following-privilege-escalation-via-traffic-cron
- [fix] froxlor bugfix release 2.3.15 https://github.com/froxlor/froxlor/releases/tag/2.3.15
- [fix] Fix commit 0805a7e https://github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8

## From the sources

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_