CVE-2026-65643

Published Sep 1, 2026

Last updated 6 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-65643 is an arbitrary file creation flaw, also described as an "eval injection" vulnerability, found within the domain parking and addon domain features of cPanel & WHM. This vulnerability allows an authenticated cPanel account holder, who possesses the permissions to add parked or addon domains, to write arbitrary files to any location on the server. Successful exploitation of CVE-2026-65643 can lead to code execution as the root user, granting an attacker full control over the entire server, including all hosted accounts, websites, and databases. The flaw affects all supported versions of cPanel & WHM prior to the release of patches on August 27, 2026, following its discovery by cPanel support technician Devon Courtney.

Description: Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
Source: support@hackerone.com
NVD status: Analyzed
Products: cpanel

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

support@hackerone.com: CWE-95

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3B5D983A-D8CB-4617-A070-A02B0331EF08",
            "versionEndExcluding": "11.110.0.141",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B6D356FF-9F0D-4B97-8901-FF44AFE5D085",
            "versionEndExcluding": "11.134.0.53",
            "versionStartIncluding": "11.112.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5CFFFED5-69DF-45CB-BF29-F1E541573859",
            "versionEndExcluding": "11.136.0.37",
            "versionStartIncluding": "11.136.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A51AD827-584B-4247-BF06-87BB15BC6315",
            "versionEndExcluding": "11.138.0.2",
            "versionStartIncluding": "11.138.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A565CA38-9709-4030-BCD8-F8AB0402FAAB",
            "versionEndExcluding": "11.138.1.7",
            "versionStartIncluding": "11.138.1.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.