Froxlor CVE-2026-113678

Requires a valid, authenticated Froxlor customer account (PR:L) that has filesystem write access to its own document root - the attacker must be able to delete the stats subdirectory and create a symlink in its place (standard for FTP/SSH-enabled hosting customers). Statistics generation (goaccess, webalizer, or awstats) must be enabled so the affected traffic-cron code path runs, and the root-scheduled traffic cron must execute for the recursive chown to follow the symlink. Limiting factors: exploitation is gated by possession of a customer account, by the stats feature being active, and by the timing of the scheduled cron run; it cannot be performed by an unauthenticated remote actor and does not apply to single-tenant or stats-disabled deployments. Affected versions are Froxlor before 2.3.15.

This is a genuine high-priority local privilege escalation to root on a shared-hosting server, not merely a high-CVSS paper risk. The CVSS 4.0 vector (9.4) reflects full confidentiality/integrity/availability impact on both the vulnerable system and subsequent systems (SC:H/SI:H/SA:H), which is appropriate because a Froxlor customer gaining root compromises every other tenant on the host. PR:L correctly captures that a valid customer account is required, and AC:L/UI:N indicate reliable exploitation once that account exists. One signal is worth scrutinizing: the provided vector lists AV:N, but exploitation requires the attacker to place a filesystem symlink inside their own document root (via FTP/SSH/shell access customers normally have) and then wait for the root-run traffic cron - this is fundamentally a local filesystem race/substitution rather than a purely network-delivered request, so AV:L is the more honest characterization (see assessed vector). No EPSS score was supplied, so widespread-exploitation probability cannot be quantified; this flaw is not on CISA KEV and no public exploit was provided in the input. The combination (authenticated-but-low-privilege prerequisite, root outcome, confirmed vendor patch) means operators running multi-tenant Froxlor should patch promptly, while the limited real-world footprint of the product tempers the aggregate risk.

A legitimate paying customer on a shared Froxlor host replaces the 'goaccess' (or webalizer/awstats) statistics directory inside their own document root with a symlink pointing at a root-owned directory such as /etc or /root. When the scheduled root-run traffic cron next executes, Statistics::makeChownWithNewStats performs a recursive chown that follows the symlink and hands ownership of the targeted root-owned tree to the attacker, who then edits a root-writable file to escalate to full root on the host. No public exploit code was provided in the input, though VulnCheck published a detailed advisory and the vendor patch reveals the exact mechanism.