Link following in Froxlor - #VU162727
Published: November 9, 2026
Vulnerability identifier: #VU162727
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local low-privileged attacker to take ownership of arbitrary host directories, exposing TLS private keys and enabling Apache configuration changes.
The vulnerability exists due to missing symlink containment in Froxlor's root traffic cron when recursively changing ownership of customer statistics directories. A local low-privileged attacker with a domain and document-root write access can replace goaccess with a symlink to obtain ownership of its target when the default-enabled cron runs.
Affected software
Froxlor
Remediation
Install security update from vendor's website.
Froxlor - update to 2.3.15