CVE-2026-29205

Published: May 13, 2026Modified: Aug 12, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Exploitability: 3.9 / Impact: 4.7

Source: support@hackerone.com (Secondary)

Description

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Affected (14)

Products: Cpanel: Cpanel, Wp Squared, Whm

3 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Cpanel Cpanel	120.0.0 ≤ version < 124.0.38
Cpanel Cpanel	126.0.0 ≤ version < 126.0.59
Cpanel Cpanel	130.0.0 ≤ version < 130.0.23
Cpanel Cpanel	130.0.23 ≤ version < 130.0.23
Cpanel Cpanel	132.0.0 ≤ version < 132.0.32
Cpanel Cpanel	134.0.0 ≤ version < 134.0.26
Cpanel Cpanel	136.0.0 ≤ version < 136.0.10
Cpanel Wp Squared	120.1.0 ≤ version < 136.1.12

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Cpanel Whm	120.0.0 ≤ version < 124.0.38
Cpanel Whm	126.0.0 ≤ version < 126.0.59
Cpanel Whm	130.0.0 ≤ version < 130.0.23
Cpanel Whm	132.0.0 ≤ version < 132.0.32
Cpanel Whm	134.0.0 ≤ version < 134.0.26
Cpanel Whm	136.0.0 ≤ version < 136.0.10

Related CWEs

CWE-250

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (1)

https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026

Source: support@hackerone.com

PatchVendor Advisory

Timeline

No history available yet.