cPanel has issued security updates across all supported release tiers to address a high-severity flaw in its EmailTrack delivery tracking component. Tracked as CVE-2026-67401, the vulnerability stems from an unsanitized SQL injection condition accessible to authenticated account holders possessing standard mail-handling privileges. By injecting crafted queries into the delivery tracking database routines, an unprivileged shared hosting tenant can write arbitrary files to restricted filesystem paths, bypassing container isolation and elevating execution to the root user context.

The flaw affects all active release branches of cPanel & WHM, including 11.110, 11.134, 11.136, 11.138, and WP Squared. cPanel has patched the issue in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9. Server operators can remediate vulnerable systems via WHM or by invoking /usr/local/cpanel/scripts/upcp --force from administrative shells.

Why it matters:

• Shared hosting perimeter collapse: Standard web hosting trust boundaries rely strictly on OS-level tenant isolation; an authenticated mail-privileged user escaping to root fully compromises co-tenancy, cross-account databases, and hypervisor management agents.
• Immediate hosting fleet patching: With proof-of-concept exploits circulating and automated shared-hosting account registration easily accessible, providers must force updates across all cPanel nodes to eliminate the file-creation primitive before widespread exploitation occurs.