Froxlor Symlink Flaw in Traffic Cron Lets Auth Users Hijack Root Directories Before 2.3.15

Security researchers have identified a critical symlink following vulnerability in Froxlor versions prior to 2.3.15. The flaw resides in the Statistics::makeChownWithNewStats function and allows authenticated customers to escalate privileges to the root level. This issue arises from how the system handles directory ownership during traffic statistics generation, creating a path for local users to compromise the entire host.

The risk

The vulnerability is rated as critical with a CVSS score of 9.4. An attacker with a valid customer account can replace the goaccess statistics directory within their document root with a symbolic link. When the root-run traffic cron job executes, it performs a recursive chown operation on this directory. Because the directory is now a symlink pointing to an arbitrary host location, the command transfers ownership of those root-owned trees to the attacker.

Who is exposed

Any organization running Froxlor versions earlier than 2.3.15 is exposed to this risk. The flaw specifically targets environments where the traffic statistics cron job runs with root privileges. Authenticated users who have access to their document root can exploit this misconfiguration to gain control over sensitive system directories. This includes small businesses and hosting providers using older versions of the control panel.

Cost and compliance

The source material does not provide specific financial costs or compliance implications for this vulnerability. However, gaining root access typically violates security frameworks that require strict privilege separation and least-privilege access controls. Organizations must assess their exposure based on their current Froxlor version and the sensitivity of the data hosted on affected servers. No remediation costs are detailed in the advisory.

What to watch

Teams should verify their current Froxlor version immediately to determine if they are running a vulnerable build. Monitor for any unexpected changes in file ownership within system directories, particularly those outside the web root. If you cannot upgrade to 2.3.15 or later, consider disabling the traffic statistics cron job as a temporary mitigation measure until a patch is applied.

Signals worth monitoring

Security teams usually detect symlink abuse by monitoring for unexpected changes in file ownership or permissions on system directories. Alerts should trigger when a user modifies the ownership of files they do not normally control. Check whether cron jobs are executing commands on symbolic links that point outside expected directories. Look for new processes spawned by the web server user that attempt to access root-owned resources. Verify that no unauthorized users have gained access to sensitive configuration files.

What to do and how to stay safe: Froxlor

• Update Froxlor to version 2.3.15 or later once the vendor provides the confirmed fix.
• Audit cron jobs to ensure they do not execute recursive ownership changes on user-writable directories.
• Monitor file integrity logs for unexpected modifications to system directory ownership.
• Review access controls for authenticated users to limit their ability to create symbolic links in document roots.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-113678?

The CVSS score for CVE-2026-113678 is 9.4, which is classified as critical.

Which versions of Froxlor are affected by this vulnerability?

Froxlor versions before 2.3.15 are affected by this symlink following vulnerability.

How does an attacker exploit this flaw?

Attackers replace the goaccess statistics directory with a symlink, causing the root-run cron job to transfer ownership of arbitrary host directories to them.