cyfenced.com →

[ CVE-2026-113678 · Published 20 Oct 2026 ]

Vulnerability in froxlor

CVSS 9.9 EPSS <1%1 agency advisoryNo fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.9

[ Description ]Official description

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References