CVE-2026-113678 is a critical symlink-following flaw in Froxlor before version 2.3.15: an authenticated customer can make a cron job that runs as root hand them ownership of any directory on the host, which leads to root access.
What Is It
The flaw is in Froxlor's Statistics::makeChownWithNewStats function, which the root-run traffic cron calls. It is classed as CWE-59 (Improper Link Resolution Before File Access, or "link following"). An authenticated customer can replace the goaccess statistics directory in their own document root with a symlink. When the traffic cron runs, it executes chown -R on that path and follows the symlink. Root-owned directories on the host then become owned by the attacker, which allows privilege escalation to root.
VulnCheck reported the issue. NVD published the record on 2026-10-20, and its status is currently "Deferred."
Why It Matters
Froxlor is a server management panel where many customers share one host. On vulnerable installs where customers can manage files in their document roots and the traffic cron processes goaccess statistics, a customer account can be used to escalate to root and potentially take over the whole server. VulnCheck scores it:
- CVSS 3.1: 9.9 Critical (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.4 Critical
The attack works over the network, is easy to carry out and needs no user interaction. It only requires a low-privilege customer account. The scope is "changed," meaning the impact goes beyond the customer's own account to the underlying host. Confidentiality, integrity and availability impacts are all rated high.
There is no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE in the supplied data. The data does not confirm active exploitation.
What's Vulnerable
- Product: froxlor/froxlor (Composer package
pkg:composer/froxlor/froxlor) - Affected versions: all versions before 2.3.15
- Unaffected: 2.3.15 and later
The vulnerable code is in lib/Froxlor/Http/Statistics.php (lines 144–162 in version 2.3.14). Any Froxlor install running a vulnerable version is exposed if it lets untrusted or semi-trusted customers manage files in their document roots.
Patch Status
Froxlor 2.3.15 fixes the flaw. The upstream fix is commit 0805a7e, and the project has published GitHub Security Advisory GHSA-vwjv-x8ff-4cvv. Administrators should upgrade to 2.3.15 or later.
There is no CISA KEV required action or due date, because the CVE is not listed in KEV.