Froxlor has released version 2.3.17, a security update that addresses 26 commits primarily focused on patching significant vulnerabilities, including symlink-based root escalations and nginx file-protection issues. This release follows a major 2.3 rewrite from December 2025, which exposed numerous security flaws, prompting ongoing updates to bolster the software's defenses. Enhancements have been made in input validation to prevent command injection, and access control measures have been tightened to safeguard against cross-tenant attacks. Operators are urged to upgrade to version 2.3.17 immediately, especially if their instances are internet-facing, and to review specific settings and configurations as part of their upgrade process

Froxlor 2.3.17 Security Release Patches Major CVEs and Symlink Vulnerabilities

Floxlor released 2.3.17 today as its latest security hardening pass, with nearly all 26 commits tagged [Security]. The drop closes a cluster of flaws spanning symlink-based root escalation, nginx file-protection holes, and input-validation gaps that reach root-run configs. It's part of a long chain of fixes aimed at the weaknesses exposed by the December 2025 2.3 rewrite. Operators running any 2.3.x instance should upgrade right away, especially if the panel is internet-facing.

Froxlor 2.3.17 Security Release Patches Major CVEs and Symlink Vulnerabilities @ Linux Compatible