{"id":"CVE-2026-113678","published":"2026-10-20T16:17:12.613","lastModified":"2026-10-23T02:16:56.567","description":"Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Http/Statistics.php#L144-L162","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8","tags":[]},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv","tags":[]},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.15-symlink-following-privilege-escalation-via-traffic-cron","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv","tags":[]}],"exploitRefs":[{"url":"https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Http/Statistics.php#L144-L162","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8","tags":[]},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv","tags":[]}],"hasPoc":true,"ai":{"summary":"Froxlor's Statistics::makeChownWithNewStats function is vulnerable to symlink following that allows authenticated users to gain root privileges by manipulating the goaccess statistics directory symlink, leading to arbitrary directory ownership and potential system compromise.","exploitability":"Exploitation requires an authenticated customer account with access to their document root, but is relatively straightforward once achieved as it leverages the root-run traffic cron process to perform chown operations on arbitrary directories.","blast_radius":"If exploited, attackers can gain full root access to the server, potentially compromising all hosted websites and system resources, with impact extending to all customers sharing the same Froxlor installation.","remediation":"Upgrade to Froxlor 2.3.15 or later to address this symlink following vulnerability in the statistics module.","detection":"Monitor for unauthorized symlink creation in customer document roots, particularly targeting goaccess directories, and watch for chown operations with root privileges being executed by the traffic cron process.","tags":["privilege-escalation","symlink","web"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:19:30.999Z"}}