Froxlor 2.3.17 patches a cluster of security flaws left open by its 2.3 rewrite
Floxlor's newest security release is out, and it reads unmistakably like one. The open-source control panel published version 2.3.17 today, and almost every commit in that drop carries a [Security] tag. Out of 26 commits, 24 harden something. Only two are ordinary bug fixes. That is a lot of single-minded focus for one release.
Floxlor is a PHP control panel built on MySQL or MariaDB, licensed under GPL-2.0. It lets hosting providers, agencies, and self-hosters juggle domains, DNS, SSL certificates, databases, FTP accounts, and resellers from a single web interface. The project is a 2010 fork of the older SysCP, and it sells itself as the free, transparent alternative to cPanel, Plesk, and DirectAdmin. You don't get billed per customer, and that's usually enough to keep small hosts around.
The 2.3 major line shipped December 3rd, 2025, after a rewrite that added SSH-key management, a modernized ISPConfig-style API, HTTP/3 support for nginx, and Debian 13 support. Big rewrites always surface bugs, but Froxlor's landed heavier than most, opening a 2026 that looked rough from a security angle.
Floxlor gets almost no press outside security advisories, which is partly why these CVE-heavy years slip under the radar. It runs quietly on what must be a few thousand self-hosted setups, nobody writes feature pieces about it, and you won't see it on any conference mainstage. But when it does get flagged, it tends to get flagged in bulk.
The two problems at the center of this release have haunted Froxlor all year: symlinks and settings written straight into root-level configs. Path validation now fully resolves symlinks before accepting a customer-supplied path, and a root-owned directory-creation routine has been hardened against symlink-swap races. Both close a GHSA-flagged advisory. Keep in mind that the direct advisory page for GHSA-jpg6-j246-v2jh returned a 404 at time of research, so its full text couldn't be independently pulled, Froxlor references it in the release notes alone.
The nginx side had its own problems. In some setups, PHP files inside protected directories were served as plain text, and the directory-protection rules didn't reliably block .php requests, regex locations, or subfolders. That's a fairly direct route to leaking source code and database credentials to any visitor. The release closes those gaps.
There's input validation too. Froxlor writes certain settings verbatim into webserver configs or feeds them to root-run commands, so unvalidated input is straight-up dangerous here. This pass validates cipher lists, HSTS max-age, HTTP group settings, and even escapes the chown owner specification, cutting off a common command-injection path.
On the access-control front, Froxlor is tightening boundaries. Several destructive actions now strictly require the change_serversettings permission, and API checks have been scoped so callers can only manage exactly what they're allowed to. There's also a push to honor the customer_hide_options privacy opt-out across the UI, logger, and API, a cleanup that started a couple of releases back with traffic data, and one the team has been methodically finishing.
Not everything is about bolting holes shut. There's a small fix for cronjob column sorting (issue #1432), a grouping fix for reseller system-log queries (#1433), and a housekeeping commit that refreshed SECURITY.md after the project left the huntr disclosure platform.
Why this class of bug matters here
For a panel that hands webspace to untrusted tenants, several of these are cross-tenant attacks. A single malicious customer could potentially read other customers' data, escalate to root, or poison the provider's own webserver config. That isn't a hypothetical scenario either. Froxlor's 2026 disclosure history is long: CVE-2026-100716 alone was a critical CVSS 9.4 symlink-based root escalation through the data-export cron, and Germany's CERT-Bund actually issued a warning about panel deployments this year.
This isn't the first hardening pass. The 2.3 line ran through a near-continuous cycle of security releases through 2026, 2.3.4 through 2.3.10, the bulk of the worst holes closed in 2.3.12 (August), then further work in 2.3.15 and 2.3.16. This is just the latest link in that chain, roughly four months on.
So what does a release this dense actually tell you? Partly that the 2.3 rewrite left gaps worth exploiting, and this drop is the direct fallout. The better reading is that the team is iterating fast and consolidating rather than patching one flaw at a time. Bundling everything into a single drop is the right call, if a little heavy-handed. Better to knock it all out at once than live with a half-hardened panel.
What you should do
Operators running any 2.3.x instance should update to 2.3.17 or later, especially if the panel faces the internet. If an immediate upgrade isn't possible, prioritize the nginx directory-protection setup, the DataDump and traffic cron paths, and any settings that land verbatim in vhost configs like cipher lists, HSTS, and HTTP groups. Back up the Froxlor database beforehand, standard practice, and skim the diff before going in.
The release ships as a ~4.45 MB tarball or a ~5.91 MB zip. The full changelog and the diff against 2.3.16 are on GitHub under the 2.3.16...2.3.17 comparison, and the docs live at docs.floxlor.org.
Head here to the GitHub release announcement.
