8.6High

CVE-2026-29205

WebPros cPanel; WebPros WP Squared Published: 2026-05-14 01:06 (6 months ago)

Description

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Weakness (CWE): CWE-250

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
cpanel	cpanel	120.0.0 – < 124.0.38
cpanel	whm	120.0.0 – < 124.0.38
cpanel	wp squared	120.1.0 – < 136.1.12
WebPros	cPanel	11.136.0.0 – < 11.136.0.10, 11.134.0.0 – < 11.134.0.26, 11.132.0.0 – < 11.132.0.32, 11.130.0.0 – < 11.130.0.23, 11.126.0.0 – < 11.126.0.59, 11.120.0.0 – < 11.124.0.38
WebPros	WP Squared	11.120.1.0 – < 11.136.1.12

References and patches

https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-U… PatchVendor Advisory

CPE matches (NVD) (14)

cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 120.0.0 < 124.0.38
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 126.0.0 < 126.0.59
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 130.0.0 < 130.0.23
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 130.0.23 < 130.0.23
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 132.0.0 < 132.0.32
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 134.0.0 < 134.0.26
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 136.0.0 < 136.0.10
cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:* ≥ 120.1.0 < 136.1.12
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 120.0.0 < 124.0.38
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 126.0.0 < 126.0.59
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 130.0.0 < 130.0.23
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 132.0.0 < 132.0.32
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 134.0.0 < 134.0.26
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* ≥ 136.0.0 < 136.0.10

CVSS score

8.6High

Source: hackerone · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

All scores (2)

cna	CVSS 3.1	8.6High
support@hackerone.com	CVSS 3.1	8.6High

EPSS (chance of exploitation in 30 days)

8.37%

higher than 95% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-03-04
Published2026-05-14 01:06
Reached IP-DB2026-10-24 23:42
Last updated2026-10-26 17:10

Assigned by (CNA): hackerone
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — cPanel & WHM

7.5High

CVE-2026-110688 24 days ago

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse…

7.5High

CVE-2026-110687 24 days ago

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, i…

6.5Medium

CVE-2026-110686 24 days ago

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them…

9.1Critical

CVE-2026-110685 24 days ago

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are r…

8.1High

CVE-2026-110684 24 days ago

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for obje…

7.5High

CVE-2026-110682 24 days ago

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing del…