Froxlor 2.3.16 was released as a bugfix update, adding support for PHP 8.5 and implementing a privacy fix while addressing symlink path handling issues without introducing new features. This update follows a series of security patches made earlier in the year, addressing significant vulnerabilities, including a critical privilege escalation flaw. The release aims to enhance security and maintain stability after a challenging year filled with multiple CVEs. Users are advised to update to 2.3.16 or at least ensure they are past version 2.3.12 to mitigate risks associated with the previously disclosed vulnerabilities

Froxlor 2.3.16 Releases as Low-Key Bugfix After a Year Full of CVEs

Floxlor 2.3.16 shipped today as a standard bugfix release in the project's 2.3 line. The update adds PHP 8.5 support, honors a customer's traffic-privacy setting in the listing endpoint, fixes symlink path handling, and bumps dependencies, but introduces no new features. It lands roughly a couple of weeks after 2.3.15 and nearly two months after 2.3.12, which closed most of the security holes Froxlor picked up in 2026. Those CVEs included a critical symlink-based root-escalation bug and triggered a warning from Germany's CERT-Bund agency.

Froxlor 2.3.16 Releases as Low-Key Bugfix After a Year Full of CVEs @ Linux Compatible