High SEVERITY — Vulnerability

CVE-2026-29205 — Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdav

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Platform
cPanel & WHM
CVE Record
CVE-2026-29205
CVSS Score
8.6/10
Published
13 May 2026
Views
27
Primary source: Review the official advisory at nvd.nist.gov Go to Source

Summary

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Assessment

  • CVE: CVE-2026-29205
  • CVSS base score: 8.6
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
  • Source: NVD record

References

Action

  • Verify affected systems against your inventory
  • Apply the vendor patch during a maintenance window
  • Restrict access at the network layer until patched
cpanel * wp squared * whm *

cPanel & WHM — Related Advisories

VIEW ALL →