Veille CVE

Mardi 20 octobre 2026

1 CVE sur 3

Critique 1 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « froxlor » ✕
  1. CVE-2026-113678 9.9 Critique

    froxlor

    Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.