![\"Mascote](\"\/wp-content\/uploads\/2026\/09\/ispconfig-3-3-2-v1.webp\")
<\/p>\n<\/p>\n
The ISPConfig 3.3.2<\/strong> was released on 18 September 2026 and, three days later, received the patch 3.3.2p1<\/strong>. It is an update worth applying right away: besides support for Ubuntu 26.04 and new email features, it fixes a SQL injection in the remote API<\/strong>, a privilege escalation in Fetchmail<\/strong> and a series of flaws found in a code audit. This guide summarizes what changed, what to check after the update, and how to update without surprises.<\/p>\n <\/p>\n If you're new to the panel, it's worth reading first the history of ISPConfig<\/a> and our guide to website hosting with ISPConfig<\/a>.<\/p>\n The official announcement does not cite CVE numbers, only the project issues and who reported each flaw. The two most serious:<\/p>\n Fixes from a code audit performed by siteguardian.io<\/strong> (#7044):<\/p>\n Two security-affecting bugs round out the list. The client field on forms reverted to the first item after a validation error, which could cause a record to be moved to the reseller, or a site to change directories (#7048). And a traffic quota equal to The previous cycle also shipped security fixes: ISPConfig 3.3.1<\/a>, from January of 2026, closed three privilege-escalation flaws in themes, restore, and backup download. Anyone still on 3.3.0 has even more reason to upgrade.<\/p>\n ISPConfig 3.3.2 supports Ubuntu 26.04 LTS, including the Dovecot 2.4 configuration syntax used by that version (#6996). The official list of supported distributions now reads:<\/p>\n A new option makes rspamd apply the DMARC policy<\/strong> published by the sending domain: the failing message is rejected or sent to quarantine, according to the domain's policy, The administrator's e-mail served both as the sender and as the recipient of system messages. When the administrator's mailbox is at another provider, this broke SPF: the ISPConfig server sent using a domain it does not host. In System > Main Config > Mail<\/strong> there are now two fields (#7028):<\/p>\n The update copies the administrator's current e-mail to the new field, so nothing changes until you configure another sender. It is worth taking the opportunity to use an address from a domain hosted on the server itself. Custom templates in The Among the fixes: backslashes disappearing from configuration values, such as the SMTP password (#7042); internal cron that never ran again after an aborted execution (#7034); lack of warning about failed nightly backup (#7002); On 21 September the 3.3.2p1<\/strong>, came out, which fixes issues found right after the launch. If you have already updated to 3.3.2, check if you were affected:<\/p>\n In practice: update directly to 3.3.2p1<\/strong>. The channel stable<\/em> already ships this version.<\/p>\n The simplest path is the script already installed on the server, pointing to the stable channel. Run as root:<\/p>\n Without the option, the script asks for the source; choose The alternative is the manual package. The official announcement shows the commands with the file The updater asks a few questions. The defaults suit most cases:<\/p>\n The project maintains the list of open bugs<\/a> on GitLab. Check it before updating critical servers, and file new failures on the issue tracker<\/a>. So far, the regressions confirmed by the project itself are the five fixed in 3.3.2p1. ISPConfig's GitLab sits behind a Cloudflare check, so open the links in the browser; command-line tools are often blocked.<\/p>\n 3.3.2 is a security update disguised as a feature release. Ubuntu 26.04, DMARC, and lock-free backup are welcome, but the reason to schedule the window this week is the SQL injection in the remote API and Fetchmail, especially on servers with resellers or customers using the API. Update straight to 3.3.2p1, take the backup and go through the checklist. For those setting up the server from scratch, the ISPConfig on Debian<\/a> guide shows the classic path, and the one on Nginx with multiple PHP versions<\/a> helps understand what the panel configures underneath.<\/p>","protected":false},"excerpt":{"rendered":" ISPConfig 3.3.2 ships Ubuntu 26.04, DMARC on the inbound path, database backups that don't lock up tables, and fixes a SQL injection in the remote API and a privilege escalation in Fetchmail. See what changed, the 3.3.2p1 patch, and how to update safely.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,78,71,2,120,3],"tags":[15,73,145,57,5],"class_list":["post-1634","post","type-post","status-publish","format-standard","hentry","category-debian","category-email","category-hospedagem","category-linux","category-servidores","category-ubuntu","tag-debian","tag-hospedagem","tag-ispconfig","tag-painel","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/1634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/comments?post=1634"}],"version-history":[{"count":2,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/1634\/revisions"}],"predecessor-version":[{"id":1637,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/1634\/revisions\/1637"}],"wp:attachment":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/media?parent=1634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/categories?post=1634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/tags?post=1634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Security: why update now<\/h2>\n
\n
\n
Host<\/code> from the request, which allowed sending the user a link pointing to an attacker's server;<\/li>\nunserialize()<\/code> no longer accepts objects;<\/li>\ninterface\/web\/remote\/monitor.php<\/code> is removed.<\/li>\n<\/ul>\n0<\/code> was not applied, which allowed bypassing the client's traffic limit (#7024).<\/p>\nWhat's new<\/h2>\n
Ubuntu 26.04 LTS<\/h3>\n
\n
DMARC on email input<\/h3>\n
p=reject<\/code> or p=quarantine<\/code> (#6995).<\/p>\nSeparate sender for system emails<\/h3>\n
\n
admin_mail<\/code>): receives the notifications and is the reply address;<\/li>\nserver_sender_mail<\/code>): the sender of system messages, such as traffic and quota notices, monitoring, OTP, password reset, and welcome messages.<\/li>\n<\/ul>\nconf-custom\/mail\/<\/code> that set their own sender are not altered.<\/p>\nDatabase backup without locking tables<\/h3>\n
mysqldump<\/code> locks all database tables during the dump, and the site may become unresponsive while the backup runs. In System > Server Config > Server<\/strong> there is a new option for using --single-transaction<\/code> (#7049):<\/p>\n\n
--single-transaction<\/code> only when all tables use a transactional engine such as InnoDB. Databases with MyISAM or MEMORY tables continue with the lock, because without it the dump of those tables would not be consistent.<\/li>\nOther changes<\/h3>\n
\n
ispconfig_update.sh<\/code> gained a command line option to update from a specific branch.<\/li>\ncurl<\/code> as an alternative.<\/li>\n.htaccess<\/code> changing to root:root<\/code> (#7035); DivisionByZeroError<\/code> in PHP traffic statistics 8 (#7023); and BIND unable to write secondary zones on Ubuntu 24.04 with AppArmor. The full list is on the milestone 99<\/a> on the project's GitLab.<\/p>\nThe 3.3.2p1 patch: regressions already fixed<\/h2>\n
\n
\/etc\/rspamd\/local.d\/users.conf<\/code>, but the include directive remained in \/etc\/rspamd\/rspamd.conf<\/code> when it did not end with a line break. P1 removes the directive and repairs already affected servers.<\/li>\nUnsupported operand types: string + string<\/code> on PHP 8, due to incorrect reading of the output from repquota<\/code> (#7053).<\/li>\npid<\/code> was not created in sys_cron<\/code> on MySQL and MariaDB prior to 10.0.2 (#7055). And database users were not created in MariaDB prior to 10.1.3 and in MySQL prior to 5.7.8 (#7056).<\/li>\nBefore updating<\/h2>\n
\n
\/var\/backup\/<\/code>. Accept it, and also have a VM snapshot or an external database backup dbispconfig<\/code> and \/usr\/local\/ispconfig<\/code>.<\/li>\ngrep ISPC_APP_VERSION \/usr\/local\/ispconfig\/server\/lib\/config.inc.php<\/code><\/pre>\n<\/li>\nHow to update<\/h2>\n
ispconfig_update.sh --update-source=stable<\/code><\/pre>\nstable<\/code>. The channels nightly<\/code> and git-develop<\/code> are for development environments and should not be used on servers with sites in production.<\/p>\nISPConfig-3.3.2.tar.gz<\/code>; to already include the patch fixes, use the 3.3.2p1<\/code>, published in the same downloads directory:<\/p>\ncd \/tmp\nwget https:\/\/www.ispconfig.org\/downloads\/ISPConfig-3.3.2p1.tar.gz\ntar xvfz ISPConfig-3.3.2p1.tar.gz\ncd ispconfig3_install\/install\nphp -q update.php<\/code><\/pre>\n\n
yes<\/code>.<\/li>\nno<\/code> on a single server; on multi-server, only if you changed something in the permissions.<\/li>\nyes<\/code>, to apply changes to Dovecot, rspamd, Apache, or nginx. Use selected<\/code> if you want to choose service by service.<\/li>\nno<\/code>, unless you want to replace the panel certificate.<\/li>\nyes<\/code>.<\/li>\n<\/ul>\nAfter updating: checklist<\/h2>\n
grep ISPC_APP_VERSION \/usr\/local\/ispconfig\/server\/lib\/config.inc.php # 3.3.2p1\nsystemctl status rspamd dovecot postfix --no-pager\ntail -n 50 \/var\/log\/ispconfig\/cron.log<\/code><\/pre>\n\n
interface_base_url<\/code> in \/usr\/local\/ispconfig\/interface\/lib\/config.inc.php<\/code>. Without this, the link comes out with the server hostname.<\/li>\nany<\/code>, user<\/code>, admin<\/code>) is now respected. If you have security\/ids.whitelist.custom<\/code>, check that reseller-editable fields use the scope user<\/code>.<\/li>\nKnown issues<\/h2>\n
Summary<\/h2>\n