2.0.9

Released on 17. September 2026.

Polish​

• MongoDB module is in BETA and available to new installations.
• Added right-click context menu in File Manager.
• Removed support for custom plugins (was broken after the 2.0 port from python to go).
• in File Manager when setting permissions added an option to apply recursively.
• Feature Request: "Locked / Upgrade Prompt" state for disabled Feature Set modules #1079

🐛 Bug Fixes​

• Default tenant stack enables Ofelia cron with restart: infinite crash loop for tenants with no scheduled jobs #1132
• OpenPanel 2.0.8 / OpenCLI: Email Accounts UI does not list mailboxes after successful create (emails.yml cache never refreshed) #1133
• Webmail autologin fails, mailserver stuck in unhealthy state #1131
• Fixed bug on Site Manager for bulk update action on WordPress sites.
• Fixed css bug with border-b class missing on header sections in 13 templates.
• Fixed a security issue that allowed FTP account delete/password/path changes to be performed on accounts you don't own.
• Fixed a SQL injection issue in the domain root directory update endpoint.
• Fixed a SQL injection issue in the database size lookup endpoint.
• Fixed a security issue that allowed WP-Manager hardening rules to be changed on domains you don't own.
• Fixed a path traversal issue in the WordPress vulnerability scanner.
• Fixed a security issue that allowed rogue DNS records to be injected via the add DNS record API.
• Fixed a security issue that allowed deleting an email account other than the one specified in the URL.
• Added missing domain name format validation to the domain creation API.
• Hardened several opencli scripts against SQL injection as defense in depth (IP blocking, account backup, permission fixing).
• Fixed a validation bug that could let a custom SSL certificate or key path outside the allowed directory slip through.