An eval injection flaw in cPanel’s Park API allows a remote, authenticated user to execute arbitrary code as the root user. The vulnerability is caused by unsanitized input being evaluated as code, leading to full system compromise for the offending account. This flaw represents a high‑severity remote code execution vector.

The vulnerability affects WebPros cPanel installations version 11.138.0.0 and earlier. Any system running these versions exposes the API endpoint to authenticated users who can exploit the flaw.

With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires a valid authenticated session to the Park API; once accessed, the attacker can run arbitrary commands with root privileges, providing full control over the host.