cPanel EUVD-2026-91198

Requires an authenticated, low-privileged cPanel account (PR:L) with the ability to invoke the Multilang adminbin; the attacker supplies insufficiently validated input to that adminbin to inject arbitrary OS commands. The changed scope (S:C) indicates the injected commands break out of the tenant's account context to execute at server/root privilege. Limiting factors: valid cPanel account credentials are mandatory (not anonymous/unauthenticated), so realistic risk is concentrated on multi-tenant shared-hosting deployments where untrusted users hold accounts; no user interaction and no non-default configuration are required. Affected versions are below the patched builds (cPanel 11.138.0.11 / 11.136.0.45 / 11.134.0.61 / 11.110.0.148 and WP Squared 11.138.1.13).

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.0 base of 9.9 is driven by network reach (AV:N), low complexity (AC:L), no user interaction (UI:N), and critically a changed scope (S:C) with full C/I/A impact - the classic cPanel pattern where a low-privileged account-level user (PR:L) breaks out of their account boundary and executes OS commands at a higher/server privilege via the adminbin. The CWE-78 command-injection class combined with S:C is exactly the kind of flaw attackers prize on shared-hosting platforms. Signal gaps: no EPSS probability was supplied, there is no CISA KEV listing, and no confirmed public exploit - the HackerOne reference (report #4054291) is the discovery channel, not evidence of a published POC, and such reports are typically access-restricted. So real-world exploitation signals are currently absent even though the technical severity is high. The one caveat worth verifying: exploitation is NOT fully unauthenticated - PR:L means an attacker must first hold a valid cPanel account, which materially narrows the threat to malicious or compromised hosting tenants rather than anonymous internet-wide attackers.

A malicious or compromised low-privileged cPanel account holder (e.g. a shared-hosting customer) invokes the Multilang adminbin with crafted input that is insufficiently validated, injecting OS commands. Because the scope changes, the commands execute outside the account's boundary at elevated/server privilege, giving the tenant control over the host and potentially co-located accounts. No public exploit code was identified at time of analysis, though the flaw was reported via HackerOne.