{"id":243364,"date":"2026-05-10T12:07:00","date_gmt":"2026-05-10T16:07:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/10\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution\/"},"modified":"2026-05-11T01:10:10","modified_gmt":"2026-05-11T05:10:10","slug":"new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/10\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution\/","title":{"rendered":"New cPanel vulnerabilities could allow file access and remote code execution"},"content":{"rendered":"<p><a href=\"https:\/\/securityaffairs.com\/191931\/security\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution.html\">New cPanel vulnerabilities could allow file access and remote code execution<\/a><\/p>\n<p><a href=\"https:\/\/securityaffairs.com\/191931\/security\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution.html\">https:\/\/securityaffairs.com\/191931\/security\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-05-10 12:07:00<\/a><\/p>\n<p>Source Domain: <a href=\"securityaffairs.com\">securityaffairs.com<\/a><\/p>\n<p><h2>New cPanel vulnerabilities could allow file access and remote code execution<\/h2>\n<\/p>\n<p>\t\t\t\t\t\t\t<span> Pierluigi Paganini<\/span><br \/>\n\t\t\t\t\t\t\t<span><img decoding=\"async\" src=\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\" alt=\"\"\/> May 10, 2026<\/span><\/p>\n<p>\t\t\t\t\t\t<img decoding=\"async\" class=\"img-fluid mb-4\" src=\"https:\/\/i0.wp.com\/securityaffairs.com\/wp-content\/uploads\/2020\/11\/cpanel-vector-logo.png?fit=900%2C500&#038;ssl=1\" alt=\"\"\/><\/p>\n<h2 class=\"wp-block-heading\">cPanel fixed three flaws that could allow file reads, code execution, and privilege escalation. No active exploitation has been reported yet.<\/h2>\n<p>cPanel has released security updates to fix three vulnerabilities affecting cPanel &#038; WHM that could allow attackers to read files, execute code, or escalate privileges on vulnerable systems.<\/p>\n<p>Below are the descriptions for these flaws:<\/p>\n<ul class=\"wp-block-list\">\n<li><strong><strong>CVE-2026-29201<\/strong>\u00a0(CVSS score of 4.3)<\/strong>: an input validation issue in the feature::LOADFEATUREFILE adminbin call that could let attackers read arbitrary files on the server.<\/li>\n<li><strong>CVE-2026-29202<\/strong>\u00a0<strong>(CVSS score of 8.8)<\/strong>: a critical flaw in the create_user API caused by improper validation of the plugin parameter. An authenticated attacker could exploit it to execute arbitrary Perl code with the privileges of the affected account.<\/li>\n<li><strong>CVE-2026-29203<\/strong>\u00a0<strong>(CVSS score of 8.8)<\/strong>: an unsafe symlink handling vulnerability that could allow a user to change permissions on arbitrary files using chmod, potentially leading to denial-of-service conditions or privilege escalation.<\/li>\n<\/ul>\n<p>The issues have been patched across multiple supported cPanel &#038; WHM releases, including versions 11.136.0.9, 11.134.0.25, 11.132.0.31, and newer builds. Updates were also released for WP Squared and legacy CentOS 6 \/ CloudLinux 6 systems.<\/p>\n<p>Although there is currently no evidence of active exploitation, the disclosure comes shortly after threat actors weaponized another critical cPanel flaw, tracked as CVE-2026-41940, as a zero-day to deploy Mirai botnet variants. <\/p>\n<p>Users should install the latest available versions as soon as possible.<\/p>\n<p>Recently the U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added\u00a0a flaw in Microsoft Defender, tracked as\u00a0CVE-2026-41940\u00a0(CVSS score of 9.3), to its\u00a0Known Exploited Vulnerabilities (KEV)&#8230;<\/p>\n<p><a href=\"https:\/\/securityaffairs.com\/191931\/security\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New cPanel vulnerabilities could allow file access and remote code execution https:\/\/securityaffairs.com\/191931\/security\/new-cpanel-vulnerabilities-could-allow-file-access-and-remote-code-execution.html Publish Date: 2026-05-10&#8230;<\/p>\n","protected":false},"author":1,"featured_media":243365,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/securityaffairs.com\/wp-content\/uploads\/2020\/11\/cpanel-vector-logo.png","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,31,27],"class_list":["post-243364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-exploit","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/243364"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=243364"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/243364\/revisions"}],"predecessor-version":[{"id":243366,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/243364\/revisions\/243366"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/243365"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=243364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=243364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=243364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}