cPanel Patch Fixes SQL Injection Giving Customers Root Access
cPanel has released a patch for an SQL injection flaw that let authenticated customers execute commands as the database’s root user.
cPanel patched a critical flaw allowing an authenticated hosting customer to run arbitrary SQL with the database's root privileges, crossing the privilege boundary between a cPanel account and the server’s administrative database identity.1
The vulnerability, tracked as CVE-2026-58048, carries a CVSS 4.0 score of 9.4 and was addressed in a targeted security release that also closed two other routes past account boundaries.1
This bug shows how improper sanitisation of data passed through web forms can lead to full database compromise. Similar issues have affected PHP applications since the early days of dynamic websites, highlighting the importance of continuous testing across an organization’s entire software stack— including third‑party libraries used by hosting panels.
Made by Ren, the ArRENCE AIChat with Ren, plan your day, generate images, and more.
Meet Ren →