cPanel has issued a targeted security release fixing a critical vulnerability that allowed authenticated hosting customers to execute SQL commands with full administrative privileges, crossing the boundary between a standard user account and the server's root database identity. The flaw, tracked as CVE-2026-58048, received a CVSS 4.0 score of 9.4 and affects all supported versions of cPanel & WHM, along with WP Squared. The patch addresses two additional security issues that similarly enabled attackers to bypass account-level restrictions.
The database vulnerability requires a valid cPanel account with access to the MySQL or MariaDB feature. Once those conditions are met, an account holder could run arbitrary database commands with complete administrative rights. Depending on how the operating system and database engine are configured, the vendor warns this could escalate to operating-system-level compromise. cPanel shipped fixes in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. Servers unable to update immediately can temporarily revoke the MySQL feature from cPanel users, which leaves existing databases running but blocks users from adding or removing databases. CISA recorded "Exploitation: none" on August 4, assessed the flaw as non-automatable, and rated its technical impact as total.
The bug sits in cPanel's database-renaming process, according to the HackerOne CNA record. SQL mode isn't preserved when a database is renamed, causing SQL to execute in root context rather than the limited privilege scope cPanel normally enforces. The vendor's database documentation explains the system creates a replacement database, moves the original data, recreates grants and stored code, then removes the old database and its grants. The vendor advisory labels the issue a privilege escalation and avoids the term SQL injection, while the CNA classifies the same defect as CWE-89, SQL injection. cPanel credits Vincent55 Yang with reporting CVE-2026-58048 and a second flaw, CVE-2026-58047, an HTTP request-smuggling issue in cpsrvd that scores 5.6 on CVSS 4.0 and could let an unauthenticated remote attacker manipulate responses delivered to other users on the same server, potentially leaking credentials.
The severity rating measures technical danger but doesn't capture how many servers have someone positioned to exploit the flaw, which depends on who holds accounts on the box. A server whose accounts all belong to one company presents a different risk profile from one selling accounts to strangers, though the line isn't clean since accounts can be phished or resold. The same release patched a third issue in Exim, GCVE-25-2026-07-45-3, where a local user's .forward file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. Under cPanel's default configuration, the expansion and execution occur as the cPanel user, which the company says may allow privilege escalation from Team User sub-accounts. Exim 4.99.5 removes the vulnerable expansion and also fixes a High-severity local directory traversal flaw through queue-name command-line arguments that can access files outside the spool area and be used for privilege escalation. Administrators should verify their installed point release against the database advisory, as cPanel's own advisories disagree on which builds carry the fixes for all three issues. Hosting providers that segment customer access through cPanel's normal database-level privileges now face a window where those protections failed, and the patch timeline determines how long that window stayed open. For environments where one compromised account can pivot to full server control, the distinction between theoretical severity and practical exposure collapses entirely.