CVEvulnerability

CVE-2026-29205

8.6 HIGH Published 2026-05-13 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-13
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-250

Description

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Affected configurations

• cpanel cpanel (>= 120.0.0 < 124.0.38) • cpanel cpanel (>= 126.0.0 < 126.0.59) • cpanel cpanel (>= 130.0.0 < 130.0.23) • cpanel cpanel (>= 130.0.23 < 130.0.23) • cpanel cpanel (>= 132.0.0 < 132.0.32) • cpanel cpanel (>= 134.0.0 < 134.0.26) • cpanel cpanel (>= 136.0.0 < 136.0.10) • cpanel wp squared (>= 120.1.0 < 136.1.12) • cpanel whm (>= 120.0.0 < 124.0.38) • cpanel whm (>= 126.0.0 < 126.0.59) • cpanel whm (>= 130.0.0 < 130.0.23) • cpanel whm (>= 132.0.0 < 132.0.32) • cpanel whm (>= 134.0.0 < 134.0.26) • cpanel whm (>= 136.0.0 < 136.0.10)

Related

Weakness · CWE (1)

  • CWE-250 Execution with Unnecessary Privileges weakness

References