CVE-2026-113678

9.9Critical

Published 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-59

Impact

Authenticated Froxlor customers can escalate privileges to root on the hosting server. They only need a standard customer account with filesystem access to their document root.

Root cause

The root-executed traffic cron script follows symlinks during a recursive chown operation in Statistics::makeChownWithNewStats.

Affected systems

Froxlor versions prior to 2.3.15

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade Froxlor to version 2.3.15 or later. As an interim workaround, disable the traffic cron job or prevent users from modifying the goaccess statistics directory path.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade froxlor

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113678