CVE-2026-29205

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Score

CVSS 3.1 8.6 High

Status

Analyzed - support@hackerone.com

Published

2026-05-13

Last modified

2026-10-26

Weaknesses

CWE-250

Affected products

• Cpanel (Cpanel)
• Whm (Cpanel)
• Wp Squared (Cpanel)
• Cpanel (Webpros)
• Wp Squared (Webpros)

References

• https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-…