CVE-2026-113678 is a reminder that a control-panel update can affect the host outside the panel's web process. The flaw let a customer-controlled statistics path reach a root chown -R in Froxlor versions 2.0.0 through 2.3.14. Froxlor 2.3.15 closes the issue, but patch assurance needs to cover the actual cron code and filesystem behavior.
Vulnerability overview
The vendor advisory describes a CWE-59 link-following defect in Statistics::makeChownWithNewStats(). A path derived from the customer document root was normalized without enforcing the optional home-directory boundary, then passed to a root ownership command. The vendor rates the issue High with CVSS 3.1 8.8. The CVE record publishes Critical CVSS 4.0 9.4 and CVSS 3.1 9.9 scores as well.
Mechanism and exploitation conditions
An authenticated customer replaces a statistics directory with a symbolic link. The next traffic-cron run resolves the link and changes ownership of the target. The advisory demonstrated the default goaccess path and notes that the ownership operation does not depend on a statistics binary being present. A customer with a writable document root and at least one hosted domain is the relevant population.
The attack is an ownership primitive. The attacker still needs a second step to turn that ownership into code execution, but the first step already crosses the host boundary and can expose secrets or configuration.
Impact
The advisory shows a tenant reading a root-held TLS private key and writing into an Apache configuration directory. Other sensitive host trees may produce similar outcomes. Service interruption is also possible if ownership changes prevent a privileged process from reading or updating files.
For management, the risk is cross-tenant. A single compromised or malicious customer can create a host-level incident. Response should involve the hosting operations team, not only the panel administrator.
Affected products and scope
Use the vendor advisory's exact range: 2.0.0 through 2.3.14 affected, 2.3.15 patched. Inventory should include VMs, containers, golden images and downstream forks. Compare the deployed code against the fixing commit, especially the second argument passed to makeCorrectDir() and the updates in traffic and fcgid cron files.
Exposure context
ZoomEye Search app="Froxlor" returned 13,007 matches. The CVE Filter returned 0. The ZoomEye query supports external asset discovery, but it cannot establish the current version, customer access or local path state. Use it only as a prioritization input.
Remediation and mitigations
Schedule the 2.3.15 update through normal change control, then verify the process that executes cron jobs is using the new code. Add a regression test with a link in a disposable customer document root. Review host ownership and access baselines around sensitive key, configuration and service directories for unexplained changes.
The public advisory names 2.3.15 as the patched release and does not present a complete configuration-only replacement for the code fix. Teams can reduce the traffic cron's privilege and add monitoring, but those steps should be recorded as compensating controls. Close the finding only after the code, cron execution and filesystem checks have all been confirmed.