cPanel, a widely used web hosting control panel, has addressed a critical vulnerability that could allow authenticated users to execute SQL commands with root-level privileges. This flaw, identified as CVE-2026-58048, threatens the security boundary between a cPanel account and the server’s administrative database identity. The vulnerability was resolved in a targeted security update that also fixed two additional issues.
Details of the SQL Vulnerability
The vulnerability affects all supported versions of cPanel & WHM, as well as WP Squared. It requires access to a valid cPanel account and the MySQL/MariaDB feature. Once exploited, it could enable users to run arbitrary database commands with administrative privileges, potentially compromising the operating system depending on its configuration.
cPanel has released patches for CVE-2026-58048 in the following versions: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. Administrators unable to update immediately can temporarily revoke MySQL access from users to mitigate risk.
Additional Vulnerabilities Addressed
Alongside the SQL vulnerability, cPanel addressed CVE-2026-58047, a moderate HTTP request-smuggling flaw in the cpsrvd daemon. This flaw could allow remote attackers to manipulate responses to other users on the same server. A workaround involves disabling backend connection reuse, which may increase latency and CPU usage on busy servers.
Another advisory covers GCVE-25-2026-07-45-3 in Exim, where a local user’s .forward file can trigger unsafe string expansion under certain configurations. Exim 4.99.5 addresses this issue by removing the vulnerable expansion.
Implications and Recommendations
The US Cybersecurity and Infrastructure Security Agency (CISA) has rated the technical impact of the SQL vulnerability as total, although it noted no exploitation had occurred at the time of reporting. This emphasizes the importance of maintaining updated systems to protect against potential threats.
Administrators are urged to verify their server configurations and apply the necessary patches. For systems unable to update immediately, implementing temporary security measures is crucial to safeguard sensitive data and prevent unauthorized access.
cPanel’s advisories highlight the need for vigilance and prompt action in maintaining server security. By addressing these vulnerabilities, cPanel aims to fortify the security of its platform and protect its users from potential exploits.
