Skip to main content

cPanel CVE-2026-58048

| EUVDEUVD-2026-51573 CRITICAL
SQL Injection (CWE-89)
2026-07-31 hackerone GHSA-xgvx-cwxw-9vpj
SQLi Cpanel Wp Squared
9.4
CVSS 4.0 · Vendor: hackerone
Share

Severity by source

Vendor (hackerone) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-reachable, low-complexity action needing only a standard cPanel account (PR:L); the escape into root DB context is a scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 31, 2026 - 18:02 EUVD
Analysis Generated
Jul 31, 2026 - 17:15 vuln.today
CVE Published
Jul 31, 2026 - 16:35 cve.org
CRITICAL 9.4

DescriptionCVE.org

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

AnalysisAI

Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privileged cPanel user
Delivery
Open database management interface
Exploit
Submit crafted database-rename request
Execution
SQL mode not preserved, injection reaches root context
Persist
Execute arbitrary SQL as root
Impact
Compromise other tenant databases or DB server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated low-privileged cPanel account (PR:L) with access to the database-management interface, and specifically invokes the database-rename operation, where the active SQL mode is not preserved and injected SQL is executed in the root database context. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals point to a genuine high-priority issue for multi-tenant hosting environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A malicious customer on a shared cPanel server logs into their standard hosting account and triggers a database-rename operation crafted to abuse the unpreserved SQL mode. Because the rename executes in the root database context, the injected SQL runs with full server privileges, letting the tenant read, modify, or destroy other customers' databases or escalate control of the database server. …
Remediation Apply the vendor fix by upgrading to the patched cPanel build in the 138 release series as documented in the cPanel change log (https://docs.cpanel.net/changelogs/138-change-log) and the CVE advisory (https://support.cpanel.net/hc/en-us/articles/42285745783703-CVE-2026-58048-Database-Privilege-Escalation); exact fixed build should be confirmed from those pages before scheduling. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all cPanel-managed servers and determine current patch levels to establish a complete inventory of affected systems and customer exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cpanel

View all
CVE-2023-29489 MEDIUM POC
6.1 Apr 27

An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
CVE-2018-16236 MEDIUM POC
6.1 Aug 30

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is

CVE-2020-26108 CRITICAL
9.8 Sep 25

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
CVE-2020-26105 CRITICAL
9.8 Sep 25

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
CVE-2020-26101 CRITICAL
9.8 Sep 25

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
CVE-2020-26100 CRITICAL
9.8 Sep 25

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
CVE-2020-26098 CRITICAL
9.8 Sep 25

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
CVE-2020-10121 CRITICAL
9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
CVE-2020-10119 CRITICAL
9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
CVE-2020-10118 CRITICAL
9.1 Mar 17

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
CVE-2020-10117 CRITICAL
9.1 Mar 17

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical sever
CVE-2019-17375 HIGH
8.8 Oct 09

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-58048 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy