Froxlor Symlink Vulnerability Enables Root Privilege Escalation for Authenticated Users
Before version 2.3.15, Froxlor contains a critical symlink flaw allowing customers to seize control of host directories via cron jobs.
Key points
- CVE-2026-113678 is rated 9.4 Critical by the National Vulnerability Database.
- The flaw affects Froxlor installations prior to version 2.3.15.
- Attackers need only an authenticated customer account to exploit the issue.
Authenticated customers in vulnerable Froxlor environments can escalate privileges to root by exploiting a symlink following weakness. According to the National Vulnerability Database, this critical flaw, identified as CVE-2026-113678, allows attackers to take ownership of arbitrary host directories. The vulnerability exists in versions of the web hosting control panel before 2.3.15. This attack vector grants complete server control to users who previously had limited access.
How it unfolded
- Attackers begin with a standard authenticated customer account on a Froxlor server.
- They replace the goaccess statistics directory in their document root with a symbolic link.
- A root-run traffic cron job processes the link and executes a recursive ownership change.
- The attacker gains root ownership of the targeted host directories and escalates privileges.
Who is affected
Froxlor users running any version before 2.3.15 are affected by this vulnerability. The National Vulnerability Database lists the issue as critical, with a CVSS score of 9.4. Any organization or managed service provider using these older versions exposes their infrastructure to potential root compromise. The flaw specifically impacts the Statistics::makeChownWithNewStats function within the application. Customers with valid accounts on these systems can trigger the exploit.
The fix
No independent confirmation of a patch exists outside the version designation in the source material. The vulnerability is present in Froxlor before version 2.3.15. Upgrading to version 2.3.15 or later removes the specific symlink following behavior described. Organizations should verify their current version against this threshold immediately. Delaying updates leaves the root-run cron job vulnerable to manipulation.
What made it possible
This incident illustrates the danger of privileged processes following user-controlled symbolic links. Teams usually face risks when background jobs perform recursive operations on paths defined by users. The weakness relies on a lack of validation for directory targets before applying ownership changes. This stage of an intrusion serves privilege escalation, turning limited access into full system control. Check whether cron jobs verify target integrity before executing commands.
What to do and how to stay safe: Froxlor
- Inventory all Froxlor installations to identify versions prior to 2.3.15.
- Restrict write access to directories processed by root-run cron jobs.
- Monitor for unusual changes in file ownership or permissions on host directories.
- Wait for vendor confirmation of the update before applying patches to production.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-113678?
The National Vulnerability Database rates the vulnerability as 9.4 Critical.
Which versions of Froxlor are affected?
All versions of Froxlor before 2.3.15 are affected by this flaw.
What does an attacker need to exploit this?
An attacker needs an authenticated customer account on the vulnerable system.
