Froxlor 2.3.16 ships as a tidy bugfix release, a couple of months after the panel rode out a pile-up of CVEs
The open-source hosting control panel's latest update adds PHP 8.5 support and a privacy hardening fix, sitting on top of security patches shipped earlier this year.
Floxlor 2.3.16 dropped today, and if you only skim the changelog you might think nothing happened. That's kind of the point.
The release went live at 07:19 UTC, filed by lead maintainer Michael Kaufmann, known as d00p. It's a standard bugfix in the 2.3 line, with no new features and no rearchitecture. Five entries in the changelog. Two of them are really just about keeping the software from breaking.
Here is why it earns more than a one-line blurb. Timing. 2.3.16 lands a couple of weeks after 2.3.15 and straight after a stretch in which Froxlor absorbed more security vulnerabilities than a mature open-source project usually expects to see in a whole calendar year.
What 2.3.16 actually changes
The release notes are short, so let me walk through them.
The headline item is PHP 8.5 support. Froxlor now runs on the newest major version of PHP, using Pdo\Mysql::ATTR_* constants where they exist, dropping deprecated E_STRICT usage, and dodging a couple of patterns that would otherwise choke on PHP 8.5. The project also added PHP 8.5 to its CI matrix, so at least the tests run against the new version automatically.
There is also a privacy fix. Froxlor now correctly respects a customer's customer_hide_options setting for traffic data in the Traffic.listing endpoint. Practically speaking, that means the panel stops surfacing traffic statistics to parties who had already opted out of seeing them. It is the sort of fix you never want to have to make, but closing that gap is a genuine improvement.
The remaining two fixes are smaller but worth calling out. A nicer touch: Froxlor can now render multi-line hosting plan descriptions, which helps anyone who has ever wanted to actually describe a plan in more than one line. And makeCorrectFile() now returns the symlink path itself rather than resolving straight through to the target. For a panel that hands out webspace to strangers, predictable path handling matters.
The fifth change is just a dependency bump through Dependabot. Routine, expected, and totally fine.
A rough year for Froxlor
To understand 2.3.16 you need the context. Froxlor's 2.3 major line dropped on December 3, 2025, after a substantial rewrite that brought SSH-key management, a modernized ISPConfig-style API, HTTP/3 support for nginx, and Debian 13. Big rewrites have a way of surfacing problems, and Froxlor surfaced plenty.
Between February and June 2026 the project pushed a near-continuous run of security releases, 2.3.4 through 2.3.10 all flagged as security releases. Most of the worst was patched together in the 2.3.12 security release on August 23, 2026.
The CVEs were not edge cases. CVE-2026-100716, a critical privilege-escalation hole rated 9.4 on the CVSS scale by GitHub's own advisory, let an authenticated customer turn a symlink into a stairway to root. A customer data-export cron failed to validate intermediate path components, and the cron would then, as the advisory puts it, "change ownership" of the linked tree (say, /etc) to the customer's user ID. One internet-exposed panel, and a single tenant could own the whole box. That is the detail that should make self-hosters sit up.
For what it's worth, this is a low-risk release. Fewer features means fewer ways to break. But that is arguably the right call for a security-sensitive panel that just spent eight months chasing down CVEs. Keep the lights on. Get it running on the newest PHP. Stop leaking data people asked to keep private.
In fact the disclosure history runs longer than most people realize. An independent researcher named Sarper Avci published a write-up documenting authenticated RCE-as-root through the PHP-FPM integration, and the trail goes back even further to a 2015 MySQL login information leak in the old 0.9.33.x line.
Other 2026 disclosures included an SSH key injection through authorized_keys (CVE-2026-90767), a two-factor-authentication bypass via CSRF, a mail-policy loophole, and a stored XSS hole. Germany's federal cyber-agency, CERT-Bund, went so far as to issue a warning (WID-SEC-2026-3629) telling operators to check their panels.
Set against that backdrop, 2.3.16 reads as follow-on hardening rather than a response to a fresh threat. 2.3.16 does not fix any of those CVEs directly, and those were largely handled in 2.3.12 and its siblings. The traffic-privacy fix, in particular, fits the pattern of a team still cleaning up after an initial security sweep.
If you run Froxlor
The advice here is as unglamorous as it comes. Update to 2.3.16, or at minimum make sure you are past 2.3.12. The critical symlink root-escalation bug is not the kind of thing you leave open, especially with the panel facing the internet.
Floxlor is free, open-source software under LGPLv3, written in PHP and backed by a MySQL/MariaDB database. It lives as a lightweight alternative to commercial panels like cPanel or Plesk, the kind of thing people reach for when those prices start to sting. Doerponner publishes updates fairly regularly now, with bugfix and security releases rolling out roughly monthly.
You can pick up 2.3.16 from the project's GitHub releases page, or check the compare view between 2.3.15 and 2.3.16 if you want to see exactly which commits made the cut.
