Froxlor 2.3.13 lands with vhost fixes and Let's Encrypt hardening
Froxlor 2.3.13 is now available. The open-source web hosting control panel shipped the update today, led by maintainer Michael Kaufmann.
This release focuses on regression fixes and a minor hardening change. If you are running a vhost setup with Apache or Nginx, the previous version likely broke your document-root paths. You will also notice the Let's Encrypt private key path is no longer exposed in the UI or API.
Keep in mind that this is a bugfix release, not a security update. The project recently finished a massive security cycle that patched over 20 vulnerabilities across authentication, path traversal, and CRLF injection.
The 2.3.13 changes
The release contains three commits. The most significant fix addresses a regression in getWebroot(). This core function determines where website files are served from. A refactoring change between versions 2.3.12 and 2.3.13 caused incorrect virtual host configurations for both Apache and Nginx. The fix restores proper path resolution.
The second change hides the ssl_key_file path for Let's Encrypt managed certificates. Froxlor has maintained an aggressive stance on not exposing cryptographic material paths to non-root users. This update continues that pattern.
The final commit bumps the version number and creates the official git tag.
The security-heavy 2.3.x era
The entire 2.3 line has been defined by intensive security patching. Releases like 2.3.4, 2.3.5, and 2.3.11 show a clear pattern of proactive hardening.
Version 2.3.11, published five days before this update, patched 20+ distinct vulnerabilities. It addressed two-factor authentication bypasses, symlink validation failures, CRLF injection in URL validation, and unescaped arguments in acme.sh. The list of fixes is long.
This pace raises a sustainability question. Michael Kaufmann, known as d00p on GitHub, is the sole release manager for the 2.x series. He has published every single version from 2.3.4 through 2.3.13. The project relies on a highly centralized development model. Community members contribute on specific issues, but core architecture decisions flow through one maintainer.
For what it's worth, the project funds this work through a dual business model. froxlor GmbH offers managed hosting and DevOps services out of Frankfurt. The company positions itself as a German cloud team for SaaS developers who want to outsource infrastructure while keeping data sovereignty intact.
About Froxlor
Froxlor originated as a fork of the defunct SysCP project in 2010. The 2.x rewrite, which began shipping in January 2023, marked a generational shift. The panel dropped legacy code in favor of Bootstrap 5, PHP 8 compatibility, and an API-first approach.
The current supported operating systems are Debian 12 and Ubuntu 24.04. The panel runs on PHP 7.4+ and includes built-in antispam via rspamd. It also supports multiple MySQL servers and reseller management.
Head here to get started.
