Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation
A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations.
Default Update CMD
sudo /scripts/upcp --forceSituation
A local user’s .forward file can trigger unsafe string expansion in Exim’s redirect router, allowing command injection under certain pipe transport configurations.
Affected Product Versions
| Product | Affected Versions | Patched Versions |
|---|---|---|
| Exim | Below 4.99.5 | 11.110.0.137 11.118.0.71 11.126.0.78 11.134.0.48 11.136.0.32 138.1.6 ( WP2 ) |
Impact
Under cPanel‘s Exim default configuration, this expansion and execution occurs as the cPanel user. This may allow for privilege escalation from Team User sub-accounts.
Call to action
Update to the latest patched version: How do I update cPanel/WHM?
Mitigation
Servers that cannot immediately upgrade should review their mail delivery configuration for any options that force command execution (force_command)on locally-forwarded mail, and remove or disable them as a temporary workaround until the upgrade can be applied. Once the patch is applied, it would be safe to re-enable or reapply force_command.
How to Apply the Fix
Update the affected packages on your server to the patched release, then restart the relevant services.
sudo /scripts/upcp --forceReferences
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System