An eval injection flaw in cPanel allows authenticated users to achieve remote code execution as root, posing a severe threat to server integrity.

This is an improper neutralization of directives in dynamically evaluated code (CWE-95) within the Park API. It allows a remote user with authenticated access to execute arbitrary code on the underlying operating system with root-level privileges.

The ability for an authenticated attacker to gain root access to a cPanel server represents a total compromise of the hosting environment. This level of access permits the exfiltration of sensitive customer data, the installation of persistent backdoors, and the potential disruption of all hosted services. With a CVSS score of 8.7, this vulnerability is classified as High severity and requires immediate remediation to prevent unauthorized system control.

Immediate Action: Update your cPanel installation to the latest version, ensuring you have moved beyond the affected ranges (specifically 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or 11.138.1.7).

Proactive Monitoring: Review system access logs for anomalous behavior in the Park API and monitor for unexpected process execution originating from the cPanel service user.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to filter malicious input strings directed at the cPanel API endpoints to mitigate potential exploit attempts.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the potential for full root compromise, administrators must prioritize patching this vulnerability immediately. Ensure that all cPanel instances are updated to the specified secure versions to eliminate the underlying code injection flaw and protect the integrity of your server infrastructure.