CVE-2026-113678

Summary

Froxlor's Statistics::makeChownWithNewStats function is vulnerable to symlink following that allows authenticated users to gain root privileges by manipulating the goaccess statistics directory symlink, leading to arbitrary directory ownership and potential system compromise.

Exploitability

Exploitation requires an authenticated customer account with access to their document root, but is relatively straightforward once achieved as it leverages the root-run traffic cron process to perform chown operations on arbitrary directories.

Blast radius

If exploited, attackers can gain full root access to the server, potentially compromising all hosted websites and system resources, with impact extending to all customers sharing the same Froxlor installation.

Detection

Monitor for unauthorized symlink creation in customer document roots, particularly targeting goaccess directories, and watch for chown operations with root privileges being executed by the traffic cron process.

Prioritized remediation

Upgrade to Froxlor 2.3.15 or later to address this symlink following vulnerability in the statistics module.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.