CVE ID :CVE-2026-113678
Published : Oct. 20, 2026
Description :Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
Severity: 9.9 | CRITICAL
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-113678
CVE-2026-113678 - Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
-
Starburst-David
- Posts: 405
- Joined: Wed Feb 11, 2026 8:31 pm