SQL Injection Vulnerability in cPanel's EmailTrack Component

CVE-2026-67401

What is CVE-2026-67401?

CVE-2026-67401 is a severe SQL injection vulnerability found in the EmailTrack component of cPanel, a widely used web hosting control panel developed by Webpros. cPanel provides essential tools for managing web hosting environments, enabling users to configure email accounts, databases, and website hosting settings. This vulnerability allows attackers to exploit mail-enabled accounts, gaining the ability to execute arbitrary code remotely with root privileges. The remote code execution capability stemming from this SQL injection flaw poses a critical threat, as it can enable attackers to take full control of the hosting server, leading to potential data breaches, service disruptions, and unauthorized access to sensitive information.

Potential Impact of CVE-2026-67401

1. Remote Code Execution: The vulnerability allows attackers to execute arbitrary code with root access, which can lead to complete control over the affected system, enabling the installation of malware or unauthorized services.

2. Data Breaches: With the ability to execute commands and access sensitive data, attackers can exfiltrate confidential information, including user credentials, financial data, and private communications, resulting in severe data privacy violations.

3. Service Disruption: Exploitation of this vulnerability can lead to significant service outages or disruptions, as malicious actors may alter system configurations, delete critical data, or deploy ransomware, affecting the availability of essential web hosting services for customers.

News Articles

The Hacker News

CVE-2026-67401

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

cPanel patched CVE-2026-67401, which lets a hosting account with mail privileges create files anywhere and run code as root.

References