CVE-2026-113678: Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.15
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor customer can exploit it. The attacker needs control over their document root so they can replace the GoAccess statistics directory with a symbolic link.
What conditions make a system vulnerable?
Affected installations are Froxlor versions before 2.3.15 where the root-run traffic cron processes the attacker-controlled statistics path. Exploitation depends on that cron invoking the vulnerable Statistics::makeChownWithNewStats behavior.
What is the practical impact of successful exploitation?
The traffic cron can recursively change ownership of a root-owned directory tree selected through the symlink. This can allow the customer to gain control of those files and escalate to root.
How can I tell whether an instance is affected?
Check the installed Froxlor version: versions before 2.3.15 are affected. Also review customer document roots for GoAccess statistics directories that are symbolic links and inspect traffic-cron activity for recursive chown operations on unexpected paths.