cPanel EmailTrack SQL injection flaw gives root access

A newly disclosed vulnerability in cPanel's EmailTrack feature could allow an attacker with mail-related privileges on a hosting account to ultimately run code as the root user on the server, according to an advisory cPanel published on September 8. The flaw, tracked as CVE-2026-67401, affects every supported version of cPanel and WHM, the company said. cPanel describes the issue as an SQL injection problem in EmailTrack, but its advisory does not specify which cPanel feature or privilege an account needs. The developer documentation lists EmailTrack as a module that tracks email statistics, though the advisory does not confirm that is the affected code.

cPanel is a widely used web hosting control panel. A customer typically manages one hosting account through cPanel, while the hosting provider manages the entire machine through WHM as the root user. According to the advisory, an authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. Root access is the highest level of control on a server. The security company Hadrian noted in April, when a different cPanel flaw was exploited, that taking over the panel is not the same as breaking into one customer's website because WHM gives an attacker root administrative access. An attacker with that access can read every hosting account on the machine, change files and databases, create hidden accounts, install malware, steal credentials, and move into customer networks.

cPanel listed fixed builds for the following release lines: 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9. A server can be updated from WHM under Home / cPanel / Upgrade to Latest Version. From the command line, cPanel's instructions say to log in as root and run /usr/local/cpanel/scripts/upcp --force. The patched list covers the 110, 134, 136 and 138 release lines. cPanel patched the 11.118 and 11.126 lines in its July advisories, has not listed them since, and has not said whether they are still supported. For an August flaw, the CVE record lists every version from 11.112.0.0 up to, but not including, 11.134.0.53 as affected and lists no fixed build in lines 118 or 126.

The advisory does not explain how an SQL injection problem leads to file creation and then to root access. It also offers nothing to do in the meantime for servers that cannot update straight away. This contrasts with cPanel's July 30 advisory for a database flaw, where administrators who could not upgrade were told they could temporarily remove the database feature from cPanel users. cPanel also does not say whether installing the patched build helps a server that was attacked before the update, or how an administrator would check. The advisory carries no severity score. cPanel's recent CVEs are assigned through HackerOne, and the scores have been arriving in the CVE record rather than in the advisory. The record for the August flaw was published on September 1, five days after that advisory, and scored it 8.7 out of 10 on the CVSS scale, indicating high severity. No record had been published for CVE-2026-67401 when The Hacker News checked the CVE Program's record store on September 9.

No public exploit code or report of exploitation appeared in searches on September 9, and CVE-2026-67401 is absent from CISA's Known Exploited Vulnerabilities catalog in the version released on September 8. However, neither check rules out exploitation. The April flaw, an authentication bypass that needed no account at all, is in the same catalog with known use in ransomware campaigns. Two other cPanel flaws disclosed since the end of July also start from an ordinary hosting account. A July 30 advisory covered a database flaw that could let an account with access to the database feature run database commands with full administrative privileges. cPanel described an August 27 flaw in domain parking that ended the same way as this one: code execution as root. Repositories that present themselves as working exploits for those two flaws were online when The Hacker News checked on September 9.

cPanel credits Ali Mustafa (rz1027) and abed1526 with reporting this vulnerability. The CVE record for the August flaw credits the same name, Ali Mustafa. Neither cPanel's advisories nor that record ties the two flaws to the same code. The records classify them differently: eval injection for the August flaw and SQL injection for this one, according to cPanel's own title.

For website owners and hosting providers, the immediate action is to verify that cPanel installations have been updated to one of the fixed builds. The absence of a public exploit does not mean the vulnerability is harmless, especially given the history of rapid exploitation of similar cPanel flaws. Managed hosting customers should check with their provider about patching schedules. AEU Hosting provides managed WordPress hosting and uses AEU Panel as its control panel, with updates handled by the provider, which is an example of how a managed service can offload this responsibility from the site owner.