Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation
A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations.
Default Update CMD
yum update exim && systemctl restart eximWhat this means under a SharedLicense license
Your SharedLicense license itself is not affected — this is a change in cPanel & WHM software, not in licensing. Update the exim package from your OS repository and restart the service. Licenses keep working through updates; nothing needs re-issuing or re-activating.
Situation
A local user’s .forward file can trigger unsafe string expansion in Exim’s redirect router, allowing command injection under certain pipe transport configurations.
Affected Product Versions
| Product | Affected Versions | Patched Versions |
|---|---|---|
| Exim | Below 4.99.5 | 11.110.0.137 11.118.0.71 11.126.0.78 11.134.0.48 11.136.0.32 138.1.6 ( WP2 ) |
Impact
Under cPanel‘s Exim default configuration, this expansion and execution occurs as the cPanel user. This may allow for privilege escalation from Team User sub-accounts.
Call to action
Update to the latest patched version: How do I update cPanel/WHM?
Mitigation
Servers that cannot immediately upgrade should review their mail delivery configuration for any options that force command execution (force_command)on locally-forwarded mail, and remove or disable them as a temporary workaround until the upgrade can be applied. Once the patch is applied, it would be safe to re-enable or reapply force_command.
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System