Symlink Following Vulnerability in Froxlor by Froxlor
CVE-2026-113678

9.4CRITICAL

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113678?

Froxlor before version 2.3.15 exhibits a symlink following vulnerability within the Statistics::makeChownWithNewStats function. This security issue allows authenticated users to exploit the root-run traffic cron, enabling them to take ownership of arbitrary host directories. By crafting a symlink in their document root to redirect the goaccess statistics directory, attackers can manipulate the chown -R command to transfer ownership of root-owned trees to themselves, facilitating unauthorized privilege escalation.

Affected Version(s)

froxlor 0 < 2.3.15

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://github.com/froxlor/froxlor/commit/0805a7e16a223d5...
patch
https://github.com/froxlor/froxlor/releases/tag/2.3.15
release-notes

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

euriconicacio
.