KoaPanel
IT Try it free

Security

Panel security

How we protect the servers KoaPanel runs on, and what the internal security review of October 2026 found.

How we work

  • Every site is kept apart from the others: it has its own system user, its own PHP and its own permissions. A customer must not be able to read or change another customer's files, databases or mail.
  • Signed updates: the panel installs only versions signed with our key (ed25519) and, if a new version does not start, goes back to the previous one by itself.
  • Automatic important updates: security fixes are marked as important, and panels set that way install them by themselves at night.
  • Tests before every version: besides the automatic tests of the code, a test run on a real server goes through more than a thousand checks, many of them about the separation between customers.

The internal review of October 2026

Between 24 and 26 October 2026 we checked the code of the panel and of the console in two ways:

  • with the automatic security analysis tools for Go (govulncheck, gosec), reading every finding by hand to tell real problems from false alarms;
  • with a second reading of the code, assisted by automatic analysis tools, focused on the places where the panel works with the server's administrator permissions.

What we found and fixed

  • Application updates (critical): the database copy made before updating an application installed by the panel was kept in a folder of the site. A customer could have replaced it and had it restored with the panel's permissions. The copy now stays in a reserved folder of the panel and is checked before a restore. Fixed in version 0.78.2.
  • Symbolic links between sites (high): on a server without the Isolation & limits module, a site could publish another site's files through a link. The protection is now on for every server. Fixed in 0.78.2.
  • Migration archives (medium): a crafted archive could take more space than allowed before being stopped. The limits now apply before anything is written to disk. Fixed in 0.78.2.
  • Go libraries: the panel and the console were built with Go versions with known vulnerabilities in the standard library, one reachable from the console's incoming mail. They now use Go 1.27.3. Console 1.41.5 and panel 0.78.2.

We have no evidence that these problems were exploited. Servers with automatic important updates install 0.78.2 by themselves; the others find it in Server › Updates.

What it is not

It is an internal review: not an audit by an outside company and not a certification. It did not cover every part of the code to the same depth. We will repeat it at every important change.

Reporting a security problem

If you find a security problem in KoaPanel, write to us at supporto@koapanel.app with the steps to reproduce it. We will answer, fix it and, if you wish, credit you here. Please do not publish it before the fix is available.