cPanel vulnerability

What happened

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Affected versions

cPanel: before 11.110.0.141 (semver); 11.112.0.0 through before 11.134.0.53 (semver); 11.136.0.0 through before 11.136.0.37 (semver); 11.138.0.0 through before 11.138.0.2 (semver); 11.138.1.0 through before 11.138.1.7 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.