Secure Froxlor Servers Before 2.3.15 to Block Critical Root Escalation Risk

Authenticated customers using Froxlor hosting panels before version 2.3.15 face a severe security risk that allows them to seize complete control of the underlying server. According to the National Vulnerability Database, this flaw carries a CVSS score of 9.4, rated as critical, because it enables privilege escalation to the root user.

The vulnerability exists within the Statistics::makeChownWithNewStats function of the software. An attacker who has already obtained a valid customer account can manipulate the system to take ownership of arbitrary directories on the host machine. This action effectively bypasses standard permission boundaries and grants the user administrative power over the entire server environment.

How the Attack Works

The exploit relies on the root-run traffic cron job that processes website statistics. According to the NVD record, attackers replace the goaccess statistics directory in their document root with a symbolic link. When the cron job executes the chown -R command, it follows this link and changes the ownership of the targeted host directories to the attacker.

This mechanism allows the user to hand root-owned trees to themselves. By directing the system to change ownership of critical system folders through the symlink, the authenticated customer gains root privileges. This transformation turns a standard customer account into a fully privileged administrative session on the host.

Who Is Affected

The issue impacts all installations of Froxlor running versions prior to 2.3.15. The National Vulnerability Database identifies the affected software as Froxlor before version 2.3.15. Any customer with an active account on these older versions possesses the necessary access level to trigger the vulnerability.

Small-business owners managing their own servers or using hosting providers that run outdated Froxlor panels are at risk. The threat does not require external network access beyond the standard customer login interface. Anyone with a valid username and password on an affected system can potentially execute this attack vector.

What to watch

Monitor for any unusual changes in file ownership on your server, particularly in system directories. Check logs for unexpected executions of the chown command by cron jobs. Verify that your Froxlor installation is running version 2.3.15 or later to ensure this specific flaw is addressed.

What made it possible

This incident illustrates the dangers of symbolic link traversal in privileged operations. When administrative scripts process user-controlled paths without strict validation, they can inadvertently modify protected system resources. Security teams usually implement canonical path resolution to prevent such redirections. Check whether your infrastructure validates directory targets before executing ownership changes. This control prevents attackers from substituting legitimate targets with malicious links during automated maintenance tasks.

Background: Privilege escalation vulnerabilities

Remove local administrator rights from daily users and enforce strict application whitelisting. These two steps block the majority of local privilege escalation attempts. Disable unused services and update dependencies to close known pathways that attackers use to gain higher system access.

Read the full guide: Stop Privilege Escalation: 5 Actions to Block Local Attacks

What to do and how to stay safe: Froxlor

• Verify your current Froxlor version and upgrade to 2.3.15 or newer immediately.
• Audit user accounts for any unauthorized modifications to statistics directories.
• Review cron job logs for unexpected chown commands or ownership changes.
• Restrict symbolic link creation in user-accessible directories if possible.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-113678?

The National Vulnerability Database rates this vulnerability as critical with a CVSS score of 9.4.

Which versions of Froxlor are vulnerable?

All versions of Froxlor before 2.3.15 are affected by this symlink following vulnerability.

Does an attacker need root access to exploit this?

No, the attacker only needs an authenticated customer account to initiate the privilege escalation.