Is CVE-2026-113678 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113678 being exploited in the wild.

How severe is CVE-2026-113678?

Critical severity, with a CVSS score of 9.9, published 20 October 2026.

Is there a fix for CVE-2026-113678?

Yes: fixed in 2.3.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113678 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-113678?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113678: Froxlor symlink following in Statistics::makeChownWithNewStats

CVE-2026-113678 · Severity: critical · CVSS 9.9 · Published 2026-10-20

Froxlor is an open-source web hosting control panel that manages customer websites and server resources. An authenticated customer can create a symlink in their statistics directory, which is then followed by a root-run cron job that changes ownership of files, allowing the customer to take control of arbitrary system directories and escalate privileges to root.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-113678 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113678 being exploited in the wild.
How severe is CVE-2026-113678?: Critical severity, with a CVSS score of 9.9, published 20 October 2026.
Which products and versions are affected?: Froxlor before 2.3.15.
Is there a fix for CVE-2026-113678?: Yes: fixed in 2.3.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113678 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-113678?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.15

Technical details

A symlink following vulnerability exists in the Statistics::makeChownWithNewStats method, which executes chown -R on statistics directories as root. An authenticated customer can replace the goaccess statistics directory in their document root with a symlink pointing to arbitrary host directories, causing the chown operation to hand root-owned system directories to the unprivileged customer account. This enables privilege escalation from customer to root.

Affected products

Froxlor Froxlor before 2.3.15

Timeline

2026-10-20: disclosed
2026-09-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.