CVE-2026-29205CWE-250

CVE-2026-29205

High · published May 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.3th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2026-05-14T02:16Z
Affected products (14)
ProductVersionsFixed in
cpanel/cpanel≥ 120.0.0, < 124.0.38124.0.38
cpanel/cpanel≥ 126.0.0, < 126.0.59126.0.59
cpanel/cpanel≥ 130.0.0, < 130.0.23130.0.23
cpanel/cpanel≥ 130.0.23, < 130.0.23130.0.23
cpanel/cpanel≥ 132.0.0, < 132.0.32132.0.32
cpanel/cpanel≥ 134.0.0, < 134.0.26134.0.26
cpanel/cpanel≥ 136.0.0, < 136.0.10136.0.10
cpanel/wp_squared≥ 120.1.0, < 136.1.12136.1.12
cpanel/whm≥ 120.0.0, < 124.0.38124.0.38
cpanel/whm≥ 126.0.0, < 126.0.59126.0.59
cpanel/whm≥ 130.0.0, < 130.0.23130.0.23
cpanel/whm≥ 132.0.0, < 132.0.32132.0.32
cpanel/whm≥ 134.0.0, < 134.0.26134.0.26
cpanel/whm≥ 136.0.0, < 136.0.10136.0.10
References (1)
https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026 · [email protected]
EPSS history
Timeline
  • 13 MAY 22:06Z
    Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints
    cvelistv5