CVE-2026-29205

Published: May 13, 2026Modified: Aug 12, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Exploitability: 3.9 / Impact: 4.7

Source: support@hackerone.com (Secondary)

Description

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Affected (14)

Products: Cpanel: Cpanel, Wp Squared, Whm

3 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Cpanel Cpanel	From 120.0.0 to 124.0.38
Cpanel Cpanel	From 126.0.0 to 126.0.59
Cpanel Cpanel	From 130.0.0 to 130.0.23
Cpanel Cpanel	From 130.0.23 to 130.0.23
Cpanel Cpanel	From 132.0.0 to 132.0.32
Cpanel Cpanel	From 134.0.0 to 134.0.26
Cpanel Cpanel	From 136.0.0 to 136.0.10
Cpanel Wp Squared	From 120.1.0 to 136.1.12

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Cpanel Whm	From 120.0.0 to 124.0.38
Cpanel Whm	From 126.0.0 to 126.0.59
Cpanel Whm	From 130.0.0 to 130.0.23
Cpanel Whm	From 132.0.0 to 132.0.32
Cpanel Whm	From 134.0.0 to 134.0.26
Cpanel Whm	From 136.0.0 to 136.0.10

Related CWEs

CWE-250

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (1)

https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026

Source: support@hackerone.com

PatchVendor Advisory

Timeline

No history available yet.