cPanel & WHM EmailTrack SQL Injection to Root RCE

#!/usr/bin/env bash
# check_cve_2026_67401.sh — Verify patch status for CVE-2026-67401
# cPanel EmailTrack SQL Injection (root RCE)
# Run as root on each cPanel/WHM server.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

CPANEL_BIN="/usr/local/cpanel/cpanel"

if [[ ! -x "$CPANEL_BIN" ]]; then
  echo "UNKNOWN — cPanel binary not found at $CPANEL_BIN. Is cPanel installed?"
  exit 2
fi

VERSION_RAW=$($CPANEL_BIN -V 2>/dev/null)
if [[ -z "$VERSION_RAW" ]]; then
  echo "UNKNOWN — Could not determine cPanel version."
  exit 2
fi

# Extract major.minor.patch.build
# Example: 11.138.0.4 (Build 1) or 11.138.1.9
VERSION=$(echo "$VERSION_RAW" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'| head -1)
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not parse version from: $VERSION_RAW"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)
BUILD=$(echo "$VERSION" | cut -d. -f4)

echo "Detected cPanel version: $VERSION (raw: $VERSION_RAW)"

# Patched versions per vendor advisory:
#   11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, 11.138.1.9

result="UNKNOWN"

case "$MINOR" in
  110)
    if [[ "$PATCH" -gt 0 ]] || [[ "$PATCH" -eq 0 && "$BUILD" -ge 143 ]]; then
      result="PATCHED"
    else
      result="VULNERABLE"
    fi
    ;;
  134)
    if [[ "$PATCH" -gt 0 ]] || [[ "$PATCH" -eq 0 && "$BUILD" -ge 55 ]]; then
      result="PATCHED"
    else
      result="VULNERABLE"
    fi
    ;;
  136)
    if [[ "$PATCH" -gt 0 ]] || [[ "$PATCH" -eq 0 && "$BUILD" -ge 39 ]]; then
      result="PATCHED"
    else
      result="VULNERABLE"
    fi
    ;;
  138)
    if [[ "$PATCH" -gt 1 ]]; then
      result="PATCHED"
    elif [[ "$PATCH" -eq 1 && "$BUILD" -ge 9 ]]; then
      result="PATCHED"
    elif [[ "$PATCH" -eq 0 && "$BUILD" -ge 4 ]]; then
      result="PATCHED"
    else
      result="VULNERABLE"
    fi
    ;;
  118|126)
    echo "WARNING — Release line 11.$MINOR is EOL. Patch status unknown. Assume VULNERABLE."
    result="VULNERABLE"
    ;;
  *)
    if [[ "$MINOR" -gt 138 ]]; then
      result="PATCHED"
    else
      result="UNKNOWN"
    fi
    ;;
esac

# Additional check: is EmailTrack feature accessible?
if [[ -f "/usr/local/cpanel/Cpanel/EmailTrack.pm" ]]; then
  echo "INFO — EmailTrack module present at /usr/local/cpanel/Cpanel/EmailTrack.pm"
else
  echo "INFO — EmailTrack module not found (feature may be disabled or removed)."
fi

echo "$result — CVE-2026-67401 (cPanel EmailTrack SQLi → Root RCE)"

case "$result" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac