← CVE Intelligence

CVE-2026-29201

WebPros / cPanel PUBLISHED

Description (CNA)

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Affected (CNA)

Vendor / product	Versions
WebPros / cPanel	affected 11.136.0.0 before 11.136.0.9; affected 11.134.0.0 before 11.134.0.25; affected 11.132.0.0 before 11.132.0.31; affected 11.130.0.0 before 11.130.0.22; affected 11.126.0.0 before 11.126.0.58; affected 11.124.0.0 before 11.124.0.37; affected 11.118.0.0 before 11.118.0.66; affected 11.110.0.0 before 11.110.0.117; affected 11.102.0.0 before 11.102.0.41; affected 11.94.0.0 before 11.94.0.30; affected 11.86.0.0 before 11.86.0.43
WebPros / WP Squared	affected 11.136.1.0 before 11.136.1.11
WebPros / cPanel (CloudLinux 6, CentOS 6)	affected 11.110.0.0 before 11.110.0.116

CWE

CWE-23

References

https://support.cpanel.net/hc/en-us/articles/40311033698327-Security-CVE-2026-29201-cPanel-WHM-WP2-Security-Update-May-08-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.