The vulnerability is a directory traversal flaw caused by a symlink following error in the Statistics::makeChownWithNewStats routine. Authenticated customers can replace the goaccess statistics directory within their web root with a symbolic link. When the root‑run traffic cron executes a recursive chown, the symlink dereferences to arbitrary host directories, allowing the attacker to change the ownership of those directories. The resulting ownership change grants the user root privileges or the ability to modify system files.

The flaw affects all Froxlor releases prior to version 2.3.15. The product Froxlor is the sole vendor and product line impacted.

The flaw carries a CVSS score of 9.4, indicating a high severity threat. No EPSS score is available, and the vulnerability is not in the CISA KEV catalog. The likely attack vector requires an authenticated user to create a symlink in the document root and relies on the traffic cron running with root privileges. Once the cron processes the symlink, the user can gain ownership of host directories, resulting in potential root‑level control. Both the high CVSS and the nature of the exploit give attackers a strong impetus to target affected installations.