CVE-2026-29205

WebPros / cPanel PUBLISHED

Description (CNA)

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Affected (CNA)

Vendor / product	Versions
WebPros / cPanel	affected 11.136.0.0 before 11.136.0.10; affected 11.134.0.0 before 11.134.0.26; affected 11.132.0.0 before 11.132.0.32; affected 11.130.0.0 before 11.130.0.23; affected 11.126.0.0 before 11.126.0.59; affected 11.120.0.0 before 11.124.0.38
WebPros / WP Squared	affected 11.120.1.0 before 11.136.1.12

CWE

CWE-250

References

https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.