Back to Security Advisories

Security Advisory: cPanel Mail Sending API Server-Side Request Forgery

A server-side request forgery flaw in cPanel's mail sending API is fixed in this security release: a caller who could reach the API could make the server issue requests of the attacker's choosing toward internal services. Apply upcp on every cPanel & WHM server.

Medium
cPanel AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9

Affected Versions

cPanel & WHM 120.0.3 and earlier

Patched Version

cPanel & WHM 120.0.6

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

dnf clean metadata
/scripts/upcp --force

AlmaLinux 8 / CloudLinux 8

dnf clean metadata
/scripts/upcp --force

CentOS 7 / CloudLinux 7

yum clean all
/scripts/upcp --force

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in cPanel & WHM software, not in licensing. Apply it on every affected server: sudo /scripts/upcp --force. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

The mail sending API exposed by cPanel & WHM accepted input that was eventually used to issue requests from the server itself — the SSRF pattern. On a hosting server, internal space includes services that were never meant to be reachable by callers: databases, management sockets, metadata endpoints. An SSRF there converts a mail feature into an internal-network probing tool.

Who is affected

cPanel & WHM servers exposing the mail sending API to accounts or integrations — typical on shared platforms where scripts send mail programmatically.

How to apply the fix

  • Update the panel: sudo /scripts/upcp --force
  • Audit API usage for unexpected destinations in mail-related logs.

For SharedLicense customers

Licensing is untouched — the fix arrives with the normal cPanel & WHM update, and licenses persist through it.

Frequently Asked Questions

What is SSRF in plain terms?
Tricking the server itself into making requests — here through the mail API — to reach internal services from outside.
Why does SSRF matter on a hosting server?
Because internal services (databases, sockets, metadata) are reachable from the server but not from the internet.
How do I patch it?
Run sudo /scripts/upcp --force on each cPanel & WHM server.

References

Security Advisories

Related Advisories

Perl-CGI Security Update — AlmaLinux 8 (ALSA-2026:99849)

2026-11-12

.NET 8.0 Security Update — AlmaLinux 8 (ALSA-2026:99052)

2026-11-12

Grafana Security Update — AlmaLinux 8 (ALSA-2026:99030)

2026-11-12

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System