Key points
- The vulnerability affects Froxlor installations running versions prior to 2.3.15.
- National Vulnerability Database rates the flaw as critical with a CVSS score of 9.4.
- Attackers can use the issue to take ownership of arbitrary host directories on the server.
Froxlor versions older than 2.3.15 contain a critical security flaw that allows authenticated customers to escalate their privileges to root. The National Vulnerability Database assigned the issue a CVSS score of 9.4, indicating a severe risk to system integrity.
In plain English
The vulnerability, identified as CVE-2026-113678, stems from how the software handles symbolic links during statistical data processing. An attacker who has a valid account can manipulate these links to trick the system into changing file ownership. This action bypasses standard security boundaries and grants the user control over files they should not access.
The background
According to the NVD record, the flaw exists in a function called Statistics::makeChownWithNewStats. This function is triggered by a root-run traffic cron job. Attackers can replace the goaccess statistics directory in their document root with a symlink. This causes the chown command to recursively hand root-owned trees to the attacker, enabling full root escalation.
What changes now
Users running Froxlor versions before 2.3.15 are exposed to this risk. The source material indicates that versions up to 2.3.14 are affected. There is no mention of a confirmed patch or update released by the vendor in the provided records. Administrators must verify their current version immediately to determine if their systems fall within the affected range.
Who needs to act first
Teams usually prioritize systems with internet-facing customer portals for immediate review. Check whether any Froxlor instances are running versions older than 2.3.15. If a fix becomes available, test it in an isolated environment before applying it to production servers. Back up configuration files and user data prior to making any changes. Monitor logs for unusual ownership changes or symlink creation attempts while waiting for vendor guidance.
What to do and how to stay safe: Froxlor
- Verify the installed Froxlor version on all managed servers to confirm if it is before 2.3.15.
- Review cron job logs for unexpected executions of the traffic statistics function or chown commands.
- Restrict write access to customer document roots where possible to limit symlink creation capabilities.
- Monitor for sudden changes in file ownership on system directories, which may indicate exploitation.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this Froxlor vulnerability?
The National Vulnerability Database rates CVE-2026-113678 as critical with a CVSS score of 9.4.
Which versions of Froxlor are affected by this flaw?
All Froxlor versions before 2.3.15 are affected by this symlink following vulnerability.
Is there a patch available for CVE-2026-113678?
The source material does not confirm that a patch or update has been released yet.
