Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation

Situation

A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations. 

Affected Product Versions

Impact

Under cPanel's Exim default configuration, this expansion and execution occurs as the cPanel user. This may allow for privilege escalation from Team User sub-accounts. 
 

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Mitigation

Servers that cannot immediately upgrade should review their mail delivery configuration for any options that force command execution (force_command)on locally-forwarded mail, and remove or disable them as a temporary workaround until the upgrade can be applied.