Medium 2026-05-19

Security Advisory: cPanel Mail Sending API Server-Side Request Forgery

cPanel AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9

The Mail Sending API allowed a reseller account to issue server-side requests to internal network endpoints, enabling internal port scanning and metadata access.

Affected Versions

cPanel & WHM 120.0.3 and earlier

Patched Version

cPanel & WHM 120.0.6

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

dnf clean metadata
/scripts/upcp --force

AlmaLinux 8 / CloudLinux 8

dnf clean metadata
/scripts/upcp --force

CentOS 7 / CloudLinux 7

yum clean all
/scripts/upcp --force

More Information

Security Advisories

Latest Advisories

ConfigServer Security & Firewall (CSF) 16.30-1 — cPanel & WHM Update

2026-08-07

Sitejet Builder 4.12.0-1 — cPanel & WHM Update

2026-08-07

cPanel & WHM version 138

2026-08-07

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System