CVE-2026-29205 - Vulnerability Analysis

Overview

Unknown vendor product contains a broken access control caused by incorrect privileges management and insufficient path filtering in cpdavd attachment download endpoints, letting attackers read arbitrary files on the server, exploit requires no special privileges.

Severity & Score

Impact

Attackers can read arbitrary files on the server, potentially exposing sensitive information.

Mitigation

Update to the latest version or apply patches that fix privilege management and path filtering.

References

• https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner