Froxlor Users Risk Total Server Compromise: Critical Cron Flaw Grants Root Access Before 2.3.15

The Froxlor web hosting control panel contains a critical symlink following vulnerability in versions prior to 2.3.15. This flaw, tracked as CVE-2026-113678, allows authenticated customers to take ownership of arbitrary host directories.

What happened

The National Vulnerability Database describes the issue as a symlink following vulnerability within the Statistics::makeChownWithNewStats function. According to the NVD record, the flaw affects all Froxlor versions before 2.3.15. The weakness is categorised under CWE-59, which relates to improper link resolution before file access.

An attacker with an authenticated customer account can manipulate the system by replacing the goaccess statistics directory in their document root with a symbolic link. This action abuses the root-run traffic cron job that processes statistical data. When the cron job executes the chown -R command, it follows the symlink and changes the ownership of the target directory to the attacker.

This mechanism allows the attacker to hand root-owned trees to themselves, effectively enabling root escalation on the host system. The NVD assigns a CVSS score of 9.4 to this vulnerability, rating it as Critical. The impact is severe because it compromises the integrity of the entire hosting environment from a single compromised user account.

Why it matters

Organisations running Froxlor on versions older than 2.3.15 face immediate risk from any authenticated user account. The ability to escalate to root privileges means an attacker gains full control over the server. This includes access to other customers' data, system configurations and potentially lateral movement within the network.

The reliance on a root-run cron job for statistics processing creates a privileged execution path that is exploited by this flaw. Security teams must treat this as a high-priority incident because the attack vector requires only a valid user login. No remote exploitation is needed, but the consequence is complete system compromise.

What happens next

• Verify the current Froxlor version installed on all hosting servers.
• Identify any systems running versions prior to 2.3.15.
• Plan an immediate upgrade to version 2.3.15 or later.
• Monitor logs for unusual chown or symlink activities in user directories.

Patch priority

Security operations teams should prioritise updating exposed internet-facing servers first. Check whether any Froxlor instances are accessible from untrusted networks. Roll out the fix in a staged manner, beginning with non-production environments. Ensure that backups of configuration files are created before applying the update. Test the upgrade process in an isolated environment to verify stability. Monitor system logs closely after the update to confirm that the cron job behaves as expected. Reduce exposure by restricting access to the control panel where possible.

What to do and how to stay safe: Froxlor

• Audit all Froxlor installations to confirm they are running version 2.3.15 or newer.
• Review user accounts for any suspicious activity or recent changes to document roots.
• Implement strict file integrity monitoring on critical system directories.
• Once the vendor provides an update, apply it promptly to all affected systems.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Froxlor are vulnerable to this symlink flaw?

All Froxlor versions before 2.3.15 are affected by CVE-2026-113678.

What is the severity rating of this vulnerability?

The NVD rates CVE-2026-113678 as Critical with a CVSS score of 9.4.

How do attackers exploit this vulnerability?

Authenticated users replace the goaccess statistics directory with a symlink to abuse the root-run traffic cron job.