New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

A vulnerability in cPanel has been discovered that allows a hosting account with mail privileges to gain control of the entire server. This is made possible by an authenticated account holder creating files on the server via EmailTrack, which can then be used to run code with root user privileges. The issue affects all supported versions of cPanel and WHM. cPanel published an advisory on this flaw, indicating that it has been patched. The patch addresses a significant security risk, as a single hosting account can potentially take control of the server.