cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root
cPanel disclosed CVE-2026-67401, an authenticated SQL injection in EmailTrack that lets attackers write files and execute code as root.
cPanel disclosed CVE-2026-67401 on September 8, 2026: a SQL injection in the EmailTrack feature that allows authenticated account holders with mail-related permissions to create arbitrary files and execute code with root privileges. Fixes shipped in v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and WP2 channel v11.138.1.9, with all supported versions before those releases affected. Root-level execution poses severe risk to shared hosting providers and multi-tenant servers, as it removes isolation between cPanel accounts, websites, mailboxes, and backups. Researchers Ali Mustafa (rz1027) and abed1526 responsibly reported the flaw.
- Authenticated cPanel accounts with mail permissions can escalate to root via arbitrary file writes.
- All supported cPanel/WHM versions before the listed patched releases are affected.
- Advises immediate patching, auditing mail privileges, credential rotation, and file integrity monitoring.
- Treat suspicious low-privilege cPanel logins as potential full-server compromise until investigated.
- CVEs
- CVE-2026-67401
- Vendors
- cPanel
- Products
- cPanel/WHMEmailTrack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67401 | Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE | 9.9 | <1% | PoC ×5 |
From the original article
2 min read at gbhackers.com
cPanel has disclosed CVE-2026-67401, a SQL injection vulnerability in its EmailTrack functionality. This flaw allows an authenticated account holder to create arbitrary files on a server, which can ultimately enable them to execute code with root privileges. The issue, published on September 8, 2026, affects all supported cPanel/WHM release versions before their respective fixes.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.