cPanel Domain Parking / Addon Domain Eval Injection to Root Code Execution

#!/usr/bin/env bash
# check_cve_2026_65643.sh — Verify patch status for CVE-2026-65643
# cPanel eval injection in domain parking / addon domain functionality
# Run on target cPanel server. No arguments required. Needs read access to /usr/local/cpanel/version.

set -euo pipefail

VERSION_FILE="/usr/local/cpanel/version"

if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — cPanel not detected (${VERSION_FILE} not found)"
  exit 2
fi

VERSION=$(cat "$VERSION_FILE" | tr -d '[:space:]')
echo "Detected cPanel version: ${VERSION}"

# Parse major.minor.patch.build
IFS='.' read -r V1 V2 V3 V4 <<< "$VERSION"

# Combine for numeric comparison: use V2 as release line, V3.V4 as build
RELEASE="${V2}"
BUILD_MAJOR="${V3}"
BUILD_MINOR="${V4}"

version_gte() {
  # Compare two dotted versions: returns 0 if $1 >= $2
  local IFS=.
  local i a=($1) b=($2)
  for ((i=0; i<${#b[@]}; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    if ((10#$ai > 10#$bi)); then return 0; fi
    if ((10#$ai < 10#$bi)); then return 1; fi
  done
  return 0
}

# Determine patch status based on release line
# Fixed versions:
#   110 line: 11.110.0.141
#   112-134 line: 11.134.0.53
#   136 line: 11.136.0.37
#   138.0 line: 11.138.0.2
#   138.1 line (WP Squared): 11.138.1.7

RESULT="UNKNOWN"

case "$RELEASE" in
  110)
    if version_gte "${BUILD_MAJOR}.${BUILD_MINOR}" "0.141"; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
    ;;
  112|114|116|118|120|122|124|126|128|130|132|134)
    if [[ "$RELEASE" -eq 134 ]] && version_gte "${BUILD_MAJOR}.${BUILD_MINOR}" "0.53"; then
      RESULT="PATCHED"
    elif [[ "$RELEASE" -lt 134 ]]; then
      RESULT="VULNERABLE"
    else
      RESULT="VULNERABLE"
    fi
    ;;
  136)
    if version_gte "${BUILD_MAJOR}.${BUILD_MINOR}" "0.37"; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
    ;;
  138)
    if [[ "$BUILD_MAJOR" -eq 1 ]]; then
      # WP Squared line: 11.138.1.x
      if version_gte "${BUILD_MAJOR}.${BUILD_MINOR}" "1.7"; then
        RESULT="PATCHED"
      else
        RESULT="VULNERABLE"
      fi
    elif [[ "$BUILD_MAJOR" -eq 0 ]]; then
      if version_gte "${BUILD_MAJOR}.${BUILD_MINOR}" "0.2"; then
        RESULT="PATCHED"
      else
        RESULT="VULNERABLE"
      fi
    else
      # Build major > 1 implies newer than patched
      RESULT="PATCHED"
    fi
    ;;
  *)
    if [[ "$RELEASE" -lt 110 ]]; then
      RESULT="VULNERABLE"
    elif [[ "$RELEASE" -gt 138 ]]; then
      RESULT="PATCHED"
    else
      RESULT="UNKNOWN"
    fi
    ;;
esac

echo "${RESULT} — cPanel ${VERSION} (release line ${RELEASE})"

case "$RESULT" in
  VULNERABLE) exit 1 ;;
  PATCHED)    exit 0 ;;
  *)          exit 2 ;;
esac