External risk intelligence

Froxlor Symlink Vulnerability Allows Host Directory Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-113678

Froxlor is a web-based server management control panel designed to be internet-facing to allow users to manage their hosting environments. As a management interface, it is typically deployed as a public-facing web application, making the administrative or customer interface accessible over the network.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Froxlor, a web-based server management tool, allows authenticated users to gain unauthorized ownership of directories, potentially leading to system control by exploiting a flaw in how statistics are handled. This issue arises from Froxlor's management of user statistics and can be leveraged to escalate privileges on the host system.

Users can take over directories with root access.
It impacts server management and hosting platforms.
Confirm if Froxlor is deployed and its specific usage.

Attack Path

How an attacker could exploit the issue

An attacker with customer-level access can initiate a path to gain root privileges by manipulating the statistics feature. This begins when an authenticated customer replaces the goaccess statistics directory within their document root with a symbolic link, directing it to an arbitrary host directory. When the system's cron job attempts to manage statistics ownership, it will instead apply root privileges to the symlinked directory, effectively granting the attacker elevated control over unintended system areas.

Requires authenticated customer access.
Abuses traffic cron and symlink.
Risk of root privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

Authenticated customers could leverage this vulnerability to gain control over arbitrary host directories. This may occur when a customer replaces the goaccess statistics directory with a symbolic link, which then allows the root-run traffic cron job to recursively change ownership of directories to root.

Host directories could be compromised.
Root-owned directories may be taken over.
Privilege escalation could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Froxlor, a web-based server management control panel. The issue is likely to be owned by the platform or infrastructure teams responsible for the server environment, with coordination from application owners who manage the Froxlor instances. The immediate first step is to identify all Froxlor deployments, confirm their network exposure and business criticality, and then assign ownership for remediation planning.

Platform/Infrastructure owns the issue.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Froxlor?

Froxlor is an open-source, web-based server management control panel used by hosting providers and administrators to simplify the management of various hosting services. It provides a web interface where users can configure domains, email accounts, and databases. Because it automates administrative tasks, it often runs with high-level system permissions to manage files and services across the server environment it controls.

What does CWE-59 mean for CVE-2026-113678?

CWE-59 refers to an Improper Link Following vulnerability. In the context of CVE-2026-113678, this means the software incorrectly follows symbolic links (shortcuts) when performing file operations. An attacker can create a link pointing to a critical system directory instead of the intended data folder. When the application performs a recursive operation like changing file ownership, it follows the link and inadvertently applies those changes to the sensitive directory the attacker targeted.

How is this vulnerability triggered?

An authenticated customer triggers the flaw by replacing the goaccess statistics directory with a symbolic link directed at a specific host directory. The vulnerability requires the system's traffic cron job—which runs with high-level root privileges—to execute its recursive ownership updates on that link. It is not triggered by standard web traffic, nor does it affect configurations where users lack the ability to manipulate their own document root directory structure.

Is my instance at risk?

According to Halo Surface Signal, Froxlor is typically deployed as an internet-facing application to allow users access to their hosting environment, which increases the likelihood of exposure. Any installation accessible over the network where customers have authenticated access to modify their directory contents should be considered relevant. You should prioritize assessment if your Froxlor instance is publicly reachable and permits standard customer account creation.

What should I do to secure my system?

The primary step is to audit your environment to identify all active Froxlor installations and confirm their current version. If you are running a version prior to 2.3.15, you must plan for an upgrade to at least 2.3.15, as this release contains the necessary fix for the symlink handling logic. Work with your infrastructure and platform teams to verify if these instances are exposed to the public and coordinate the patching process to prevent unauthorized privilege escalation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.