Froxlor 2.3.15 Patch Fixes Critical Root Escalation Flaw

Froxlor has released version 2.3.15 to fix a critical vulnerability that allows authenticated users to escalate privileges to root. The flaw, tracked as CVE-2026-113678, affects all installations prior to the new release.

What happened

According to the National Vulnerability Database, Froxlor versions before 2.3.15 contain a symlink following vulnerability in the Statistics::makeChownWithNewStats function. This flaw carries a CVSS score of 9.4, which is classified as critical. The vulnerability is categorized under CWE-59, indicating improper link resolution.

An authenticated customer can exploit this weakness by replacing the goaccess statistics directory in their document root with a symbolic link. This action abuses the root-run traffic cron job. When the cron executes, it performs a recursive chown operation on the linked path.

This process hands root-owned directory trees to the attacker. Consequently, the user gains ownership of arbitrary host directories. This enables full root escalation on the server. The issue exists in the core functionality of the hosting control panel.

Why it matters

This flaw allows a standard customer account to compromise the entire host system. Because the traffic cron runs with root privileges, the impact is severe. Attackers do not need external network access to exploit the initial vector; they only need valid user credentials.

As Patch Gazette reported on 2026-10-16, privilege escalation flaws in management interfaces remain a high risk. Similar to the Rdiffweb issue, this flaw exploits trusted internal processes. The ability to take ownership of system directories undermines all other security controls on the server.

What to watch

• Monitor vendor announcements for any follow-up patches or security advisories.
• Check system logs for unusual symlink creation in user document roots.
• Verify that cron jobs are not executing commands on untrusted paths.
• Review file ownership changes on critical system directories regularly.

Who needs to act first

Teams should prioritize updating publicly accessible Froxlor instances immediately. Systems hosting multiple customer accounts face the highest risk due to the authenticated nature of the exploit. Before applying the update, administrators should back up the current configuration and database. Testing the patch in a staging environment helps prevent service disruptions. If immediate updates are not possible, restrict customer access to the control panel to reduce the attack surface until the fix is deployed.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Froxlor

• Update Froxlor to version 2.3.15 or later to apply the official patch.
• Audit existing customer accounts for unusual file permissions or symlinks.
• Verify that the traffic cron job is running with the least necessary privileges.
• Once the vendor provides an update, test it in a non-production environment first.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Froxlor versions are affected by CVE-2026-113678?

All Froxlor versions before 2.3.15 are vulnerable to this symlink following flaw.

What is the severity of this vulnerability?

The National Vulnerability Database rates it as critical with a CVSS score of 9.4.

How does the attacker exploit this flaw?

An authenticated user replaces a statistics directory with a symlink to abuse the root-run cron.