Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation

Situation A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations. Affected Product Versions Product Affected Versions Patched Versions Exim Below 4.99.5 11.110.0.137 11.118.0.71 11.126.0.78 11.134.0.48 11.136.0.32 138.1.6 ( WP2 ) Impact Under cPanel's Exim default configuration, this expansion and execution occurs as the cPanel user. This may allow for privilege escalation from Team User sub-accounts. Call to action Update to the latest patched version: How do I update cPanel/WHM? Mitigation Servers that cannot immediately upgrade should review their mail delivery configuration for any options that force command execution (force_command)on locally-forwarded mail, and remove or disable them as a temporary workaround until the upgrade can be applied. Once the patch is applied, it would be safe to re-enable or reapply force_command.