CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root

Vulnerability Overview

Item	Detail
CVE ID	CVE-2026-67401
Component	cPanel & WHM — EmailTrack (Email ▸ Track Delivery)
Vulnerability class	CWE-89 (SQL Injection)
Disclosure date	September 8, 2026 (cPanel advisory), CVE record published September 9, 2026
Discovered by	Ali Mustafa (reported via HackerOne)
Affected versions	All supported cPanel & WHM versions (11.110, 11.134, 11.136, 11.138, WP2 line included)
Attack precondition	Authenticated as a standard cPanel account with mail-related privileges
Impact	SQL Injection → arbitrary file creation → root-level code execution

EmailTrack is the "Track Delivery" feature that lets a cPanel user review the delivery status and logs of email sent or received on their own domain. What matters here is that this feature is scoped to be a read capability within the user's own account. In cPanel's permission model, an ordinary account can only touch its own mail and domain data — full control of the server is reserved for root via WHM. CVE-2026-67401 collapses exactly that boundary with a single SQL injection.

Unusually, cPanel's advisory does not disclose the vulnerable request parameter, the actual SQL statement, or the precise mechanism connecting file creation to root execution. The analysis below is a conceptual reconstruction based on the disclosed vulnerability class (SQL Injection → file write → privilege escalation) and publicly known characteristics of cPanel's architecture — not cPanel's actual source code or a verified working exploit.

---

Exploit Flow At a Glance

1. Authenticate — The attacker logs in with a perfectly ordinary cPanel account (or a compromised one) that has mail privileges only; no separate bug is needed for this step.
2. SQL Injection — A parameter passed to the UAPI/internal endpoint behind EmailTrack (account name, domain, etc.) is concatenated directly into a SQL query.
3. File write — The injected SQL triggers an INTO OUTFILE-style clause, letting the DB server process write an arbitrary file — typically into the web root — with its own filesystem privileges.
4. Code execution — The dropped file gets interpreted (e.g., as PHP), letting the attacker run commands at that account's (or service account's) privilege level.
5. Root escalation — A local privilege-escalation path available in the cPanel environment — a SUID binary, cron, or an internal task queue — is used to finally reach root.

The critical detail is how low the bar is for step 1. The attacker doesn't need to be a server administrator — a customer holding nothing more than a single mail account can be the attacker. On a shared-hosting box, that means one compromised neighbor account can escalate to controlling the entire server and every other tenant's data.

---

How the Privilege Boundary Collapses

cPanel's permission model is simple:

• Ordinary account: access limited to its own mail, domains, and files
• WHM/root: controls the entire server and every account on it

That boundary stands on one assumption: the code never trusts user input. The moment EmailTrack concatenates user input (the account-name parameter) unsafely into a SQL query string, the boundary stops being enforced by application logic and starts being decided by whatever SQL the attacker wrote. A request that was supposed to mean "show me my own mail log" turns into something entirely different: "use the DB server process's write privilege to drop a file somewhere on this server."

---

Source-Level Analysis (Conceptual Reconstruction)

cPanel is closed-source, and this advisory published neither code nor the actual query. The snippets below illustrate "the classic SQL injection pattern of unsanitized user input concatenated into a query string" — they are not cPanel's real implementation.

1) The vulnerable pattern: building a query by string concatenation

<?php
// Illustrative: assume EmailTrack looks up delivery logs for a given account
function getDeliveryLogs($account) {
    // The risk: $account is dropped straight into the query, unvalidated and unescaped
    $query = "SELECT msg_id, sender, recipient, status
              FROM email_track_log
              WHERE account = '" . $account . "'";

    return $db->query($query);
}

Code written this way works fine as long as $account is a normal-looking value like alice. But if the input contains a single quote (') that terminates the string early, everything that follows is no longer interpreted as data — it's interpreted as SQL. That's the foundational mechanic behind SQL injection.

2) The "easy version" of SQL injection — what one quote character changes

Normal request:    account = 'alice'
                    → the DB looks up rows where account equals 'alice'

Tampered request:  account = 'alice' <additional SQL clause>
                    → the string terminates at the quote,
                      and what follows is executed as a COMMAND, not DATA

The developer assumed account would always be a "value." The database engine, however, ultimately just executes whatever string gets assembled — the entire thing is "SQL to run." That gap between assumption and reality is the essence of every SQL injection bug.

3) Where it turns into a file write — the danger of INTO OUTFILE

MySQL/MariaDB supports SELECT ... INTO OUTFILE '<path>', which writes a query's result straight to the server's filesystem. The feature itself is legitimate — exports, backups, and so on. The problem appears when this clause can be injected into SQL the attacker controls.

-- Conceptual example: a UNION-based pattern that writes arbitrary content to a file
SELECT 1, '<?php system($_GET["c"]); ?>', 3, 4, 5
INTO OUTFILE '/home/alice/public_html/.cache.php'

Once this executes, the DB server process — using its own file-write permission — creates a file containing PHP code at a path the web server can reach. If that path is configured to be interpreted as PHP, the attacker just has to visit it in a browser to run whatever code they embedded. This is the exact point where "SQL injection" becomes "code execution."

4) Why it reaches all the way to "root" — the role of local privilege escalation

Up through step 3, what the attacker gains is execution at the DB server process's level, or the compromised account's level — not root outright. When cPanel's advisory states that exploitation "leads to code execution as root," it implies a separate local privilege-escalation step kicks in from this point. cPanel/WHM environments typically offer several classic escalation surfaces:

• SUID-flagged cPanel-specific binaries: utilities designed to run as root under certain conditions
• cron jobs: root-owned scheduled scripts that may reference paths an attacker can write to
• Internal task queues: daemons that process queued work as root

cPanel hasn't disclosed exactly which escalation surface is in play here, so this write-up stops at the principle level. The key takeaway is that "SQLi → file write" isn't the whole chain — it has to be paired with a separate design flaw that bridges low privilege to root before the full attack is complete.

---

Impact

• The attack bar is unusually low — mail privileges alone are enough; no admin access required.
• Devastating on shared hosting — a single compromised account on a box with hundreds of tenants puts the entire server, and every other customer's data, at risk.
• Hard to spot — the attack's starting point is a legitimate-looking call to the EmailTrack API, so without dedicated monitoring it's difficult to distinguish from normal usage.

Patch and Remediation

Build line	Fixed version
11.110	11.110.0.143
11.134	11.134.0.55
11.136	11.136.0.39
11.138	11.138.0.4
WP2 (11.138)	11.138.1.9

Check the installed version:

cat /usr/local/cpanel/version

The fix is unambiguous: upgrade immediately via WHM's Home ▸ cPanel ▸ Upgrade to Latest Version, or run the upgrade command directly as root to move to a patched build. This is a post-authentication logic flaw rather than something a network scanner can flag in advance, so beyond upgrading there isn't a meaningful mitigation to fall back on.