ISPConfig 3.3.2: Ubuntu 26.04, DMARC, and security fixes

The ISPConfig 3.3.2 was released on 18 September 2026 and, three days later, received the patch 3.3.2p1. It is an update worth applying right away: besides support for Ubuntu 26.04 and new email features, it fixes a SQL injection in the remote API, a privilege escalation in Fetchmail and a series of flaws found in a code audit. This guide summarizes what changed, what to check after the update, and how to update without surprises.

If you're new to the panel, it's worth reading first the history of ISPConfig and our guide to website hosting with ISPConfig.

Security: why update now

The official announcement does not cite CVE numbers, only the project issues and who reported each flaw. The two most serious:

• SQL injection in the remote API (#7051). The record ID passed to the update and delete functions of the API went into the SQL query without validation. A user of the API with permission for one of these functions could alter or delete records outside their permission and read data from other tables. The ID now needs to be a positive integer and the queries use placeholders. Reported by Nguyen Chi Quang, from MBBank.
• Privilege escalation in Fetchmail (#7052). The fields of a Fetchmail account were written to the getmail configuration file without validation: with line breaks, a client could inject extra sections. Line breaks and null bytes are now removed, the destination needs to be a valid email, and the plugin refuses to write to symbolic links or outside the getmail directory. Reported by Arvin Shivram, from Brutecat Security.

Fixes from a code audit performed by siteguardian.io (#7044):

• also went in: the password reset link was assembled from the header Host from the request, which allowed sending the user a link pointing to an attacker's server;
• CSRF tokens are now required in backups, DNS zone import, extension management, and vpopmail import;
• TLS verification is back in effect when downloading extensions and APS packages;
• the session ID is regenerated on login;
• hashes and tokens are compared in constant time;
• email headers are protected against CRLF injection;
• shell arguments are now escaped in PowerDNS DNSSEC, certbot, and PostgreSQL size commands;
• APS package extraction rejects path traversal;
• unserialize() no longer accepts objects;
• the old file interface/web/remote/monitor.php is removed.

Two security-affecting bugs round out the list. The client field on forms reverted to the first item after a validation error, which could cause a record to be moved to the reseller, or a site to change directories (#7048). And a traffic quota equal to 0 was not applied, which allowed bypassing the client's traffic limit (#7024).

The previous cycle also shipped security fixes: ISPConfig 3.3.1, from January of 2026, closed three privilege-escalation flaws in themes, restore, and backup download. Anyone still on 3.3.0 has even more reason to upgrade.

What's new

Ubuntu 26.04 LTS

ISPConfig 3.3.2 supports Ubuntu 26.04 LTS, including the Dovecot 2.4 configuration syntax used by that version (#6996). The official list of supported distributions now reads:

• Debian 11 to 13 (recommended) and Debian testing;
• Ubuntu 22.04 LTS to 26.04 LTS (recommended);
• AlmaLinux 8 to 10 and Rocky Linux 8 to 10;
• CentOS 8.

DMARC on email input

A new option makes rspamd apply the DMARC policy published by the sending domain: the failing message is rejected or sent to quarantine, according to the domain's policy, p=reject or p=quarantine (#6995).

Separate sender for system emails

The administrator's e-mail served both as the sender and as the recipient of system messages. When the administrator's mailbox is at another provider, this broke SPF: the ISPConfig server sent using a domain it does not host. In System > Main Config > Mail there are now two fields (#7028):

• Administrator's contact e-mail (admin_mail): receives the notifications and is the reply address;
• Server sender e-mail address (server_sender_mail): the sender of system messages, such as traffic and quota notices, monitoring, OTP, password reset, and welcome messages.

The update copies the administrator's current e-mail to the new field, so nothing changes until you configure another sender. It is worth taking the opportunity to use an address from a domain hosted on the server itself. Custom templates in conf-custom/mail/ that set their own sender are not altered.

Database backup without locking tables

The mysqldump locks all database tables during the dump, and the site may become unresponsive while the backup runs. In System > Server Config > Server there is a new option for using --single-transaction (#7049):

• Automatic (default): uses --single-transaction only when all tables use a transactional engine such as InnoDB. Databases with MyISAM or MEMORY tables continue with the lock, because without it the dump of those tables would not be consistent.
• Yes: never locks. It is the choice for mixed databases where availability matters more than consistency of non-transactional tables.
• On: keeps the old behavior.

Other changes

• Extensible limits (#7019): extensions can register their own client and reseller limits without modifying core files.
• Updated CA list for CAA records (#7017).
• Custom error pages disabled by default on new sites; existing ones do not change (#7021).
• ispconfig_update.sh gained a command line option to update from a specific branch.
• Improvements to acme.sh for loopback addresses, with better logging in the installer and download via curl as an alternative.
• The systemd temporary directory override also now applies to the Apache unit.

Among the fixes: backslashes disappearing from configuration values, such as the SMTP password (#7042); internal cron that never ran again after an aborted execution (#7034); lack of warning about failed nightly backup (#7002); .htaccess changing to root:root (#7035); DivisionByZeroError in PHP traffic statistics 8 (#7023); and BIND unable to write secondary zones on Ubuntu 24.04 with AppArmor. The full list is on the milestone 99 on the project's GitLab.

The 3.3.2p1 patch: regressions already fixed

On 21 September the 3.3.2p1, came out, which fixes issues found right after the launch. If you have already updated to 3.3.2, check if you were affected:

• rspamd was not starting after the update with service reconfiguration (#7054). The update renamed /etc/rspamd/local.d/users.conf, but the include directive remained in /etc/rspamd/rspamd.conf when it did not end with a line break. P1 removes the directive and repairs already affected servers.
• ISPConfig cron aborting with Unsupported operand types: string + string on PHP 8, due to incorrect reading of the output from repquota (#7053).
• Old MySQL and MariaDB: the column pid was not created in sys_cron on MySQL and MariaDB prior to 10.0.2 (#7055). And database users were not created in MariaDB prior to 10.1.3 and in MySQL prior to 5.7.8 (#7056).
• Mailboxes created on the wrong server when the same domain exists on more than one mail server (#7057).

In practice: update directly to 3.3.2p1. The channel stable already ships this version.

Before updating

1. Backup. The updater itself offers to create a backup in /var/backup/. Accept it, and also have a VM snapshot or an external database backup dbispconfig and /usr/local/ispconfig.
2. Current version. Check where you are coming from:

   grep ISPC_APP_VERSION /usr/local/ispconfig/server/lib/config.inc.php

3. Multiserver. Enable maintenance mode, update the master server first, then the slaves, and only then disable maintenance. That is the order the update script itself recommends.

How to update

The simplest path is the script already installed on the server, pointing to the stable channel. Run as root:

ispconfig_update.sh --update-source=stable

Without the option, the script asks for the source; choose stable. The channels nightly and git-develop are for development environments and should not be used on servers with sites in production.

The alternative is the manual package. The official announcement shows the commands with the file ISPConfig-3.3.2.tar.gz; to already include the patch fixes, use the 3.3.2p1, published in the same downloads directory:

cd /tmp
wget https://www.ispconfig.org/downloads/ISPConfig-3.3.2p1.tar.gz
tar xvfz ISPConfig-3.3.2p1.tar.gz
cd ispconfig3_install/install
php -q update.php

The updater asks a few questions. The defaults suit most cases:

• Shall the script create a ISPConfig backup in /var/backup/ now? yes.
• Reconfigure Permissions in master database? no on a single server; on multi-server, only if you changed something in the permissions.
• Reconfigure Services? yes, to apply changes to Dovecot, rspamd, Apache, or nginx. Use selected if you want to choose service by service.
• Create new ISPConfig SSL certificate: no, unless you want to replace the panel certificate.
• Reconfigure Crontab? yes.

After updating: checklist

grep ISPC_APP_VERSION /usr/local/ispconfig/server/lib/config.inc.php   # 3.3.2p1
systemctl status rspamd dovecot postfix --no-pager
tail -n 50 /var/log/ispconfig/cron.log

• Password reset link: if the panel is accessed by a name other than the server hostname, set interface_base_url in /usr/local/ispconfig/interface/lib/config.inc.php. Without this, the link comes out with the server hostname.
• IDS Whitelist: the scope of entries (any, user, admin) is now respected. If you have security/ids.whitelist.custom, check that reseller-editable fields use the scope user.
• System sender: adjust the Server sender e-mail address if the administrator's email is off the server.
• Unblocked backup: review the new option in Server Config if your databases mix InnoDB and MyISAM.
• DMARC: enable policy enforcement at the inbound entry point gradually, monitoring the quarantine during the first days.

Known issues

The project maintains the list of open bugs on GitLab. Check it before updating critical servers, and file new failures on the issue tracker. So far, the regressions confirmed by the project itself are the five fixed in 3.3.2p1. ISPConfig's GitLab sits behind a Cloudflare check, so open the links in the browser; command-line tools are often blocked.

Summary

3.3.2 is a security update disguised as a feature release. Ubuntu 26.04, DMARC, and lock-free backup are welcome, but the reason to schedule the window this week is the SQL injection in the remote API and Fetchmail, especially on servers with resellers or customers using the API. Update straight to 3.3.2p1, take the backup and go through the checklist. For those setting up the server from scratch, the ISPConfig on Debian guide shows the classic path, and the one on Nginx with multiple PHP versions helps understand what the panel configures underneath.