high8.6
CVE-2026-29205
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Impact
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cpanel | Cpanel | from 120.0.0 before 124.0.38 from 126.0.0 before 126.0.59 from 130.0.0 before 130.0.23 from 130.0.23 before 130.0.23 from 132.0.0 before 132.0.32 from 134.0.0 before 134.0.26 |
| Cpanel | Wp Squared | from 120.1.0 before 136.1.12 |
| Cpanel | Whm | from 120.0.0 before 124.0.38 from 126.0.0 before 126.0.59 from 130.0.0 before 130.0.23 from 132.0.0 before 132.0.32 from 134.0.0 before 134.0.26 from 136.0.0 before 136.0.10 |