---
id: CVE-2026-65643
title: >-
  Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated
  users to execute arbitrary code as root.
summary: >-
  Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated
  users to execute arbitrary code as root.
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-95
vendor: cpanel
product: cpanel
affected:
  - cpanel < 110.0.141
  - 'cpanel >= 112.0.0, < 134.0.53'
  - 'cpanel >= 136.0.0, < 136.0.37'
  - 'cpanel >= 138.0.0, < 138.0.2'
  - 'cpanel >= 138.1.0, < 138.1.7'
patched:
  - cpanel 138.1.7
published: '2026-09-01'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T04:18:24.863'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65643'
references:
  - url: >-
      https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-August-27-2026
    label: support@hackerone.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00875
epssPercentile: 0.58776
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit'
    - 'https://github.com/HORKimhab/CVE-2026-65643'
  checkedAt: '2026-10-27T19:07:40.372Z'
exploitAvailable: true
ingestedAt: '2026-09-05T19:43:56.479Z'
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-01T00:00:00+00:00'
scores:
  nvd: 8.8
  cna: 8.7
---

## Overview

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

## Affected

- `cpanel < 110.0.141`
- `cpanel >= 112.0.0, < 134.0.53`
- `cpanel >= 136.0.0, < 136.0.37`
- `cpanel >= 138.0.0, < 138.0.2`
- `cpanel >= 138.1.0, < 138.1.7`

## Remediation

Upgrade past the affected range:

- `cpanel 138.1.7`