CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113678?
CVE-2026-113678 is a critical vulnerability in froxlor, published on 20 Oct 2026.
Official description
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
Weakness: CWE-59
Which versions are affected by CVE-2026-113678?
How do I fix CVE-2026-113678?
No fix has been published for CVE-2026-113678 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113678 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113678 exists.
Sources
Also known as GHSA-j3hm-8rm8-m243, GHSA-vwjv-x8ff-4cvv.