Froxlor vs Sanity

Every froxlor release since February has been titled a security release, and the pattern inside them is consistent: batches of validation fixes across the API and frontend rather than responses to single disclosures. The work covers DNS record content validation across LOC, RP, SSHFP, TLSA, NAPTR and TXT types, path traversal and symlink resolution in data export and authorized_keys handling, ownership checks in email and domain operations, CSRF tokens on AJAX actions, and requiring the current password before generating an API key. The June sequence — 2.3.8, then 2.3.9 and 2.3.10 the same day — shows a regression being chased immediately after a fix.

This reads as a systematic audit being worked through in order rather than incident response. The fixes group by class — first DNS record content, then path and symlink containment, then ownership and authorisation checks, then CSRF and response filtering — which is what a methodical pass over a hosting control panel's attack surface looks like. A control panel is an unusually high-value target since it holds root-adjacent capability over customer domains, mail and databases, so the concentration on ownership validation and path containment is well aimed. Feature work is essentially absent; the non-security content is translations and dependency bumps.

Expect the security-release cadence to continue until the audit is exhausted, with the remaining validation surface — likely the config-service and task-generation paths — as the next area. The same-day 2.3.9 and 2.3.10 sequence suggests the team will keep shipping fast follow-ups rather than batching regressions into the next monthly release.