Froxlor: Symlink following leads to local privilege escalation
Summary
Froxlor before 2.3.15 follows symlinks in the traffic statistics handling (Statistics::makeChownWithNewStats). A customer with a valid login can replace the goaccess statistics directory in their document root with a symlink. The root-run traffic cron then runs chown -R on the link target, which transfers ownership of root-owned directories to the customer and enables escalation to root on the server.
Affected
- Froxlor before 2.3.15 (CVE record: affected 0 to < 2.3.15; VulDB also lists up to 2.3.14)
Fixed in
- Froxlor 2.3.15 (fix commit 0805a7e16a223d528b51d8cacfaff54217b9d8f8)
Workaround
Unknown. No vendor-documented workaround was found. Upgrading to 2.3.15 is the only fix named in the sources.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total
- No confirmed exploitation in the wild and no public exploit found in the sources.
- Not listed in CISA KEV according to a third-party aggregator; not independently confirmed.
Our recommendation
- Identify all Froxlor installations and their versions.
- Upgrade every installation below 2.3.15.
- If the upgrade is delayed, review customer accounts and restrict customer write access to document roots where possible.
- Review customer-level file access on the server and monitor for unexpected ownership changes in customer directories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Froxlor GitHub Security Advisory GHSA-vwjv-x8ff-4cvv github.com
- Froxlor 2.3.15 release github.com
- Fix commit 0805a7e github.com
- VulnCheck advisory: Froxlor symlink following privilege escalation www.vulncheck.com
- Vulnerable code Statistics.php at 2.3.14 github.com
- VulDB entry 422886 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:00.
Original description (NVD)
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
NVD references (6)
- https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Http/Statistics.php#L144-L162
- https://github.com/froxlor/froxlor/commit/0805a7e16a223d528b51d8cacfaff54217b9d8f8
- https://github.com/froxlor/froxlor/releases/tag/2.3.15
- https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv
- https://www.vulncheck.com/advisories/froxlor-before-2.3.15-symlink-following-privilege-escalation-via-traffic…
- https://github.com/froxlor/froxlor/security/advisories/GHSA-vwjv-x8ff-4cvv
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.