Quick Look: CVE-2026-29205 — Arbitrary File Read in cPanel cpdavd Attachment Endpoints

Introduction

An unauthenticated arbitrary file read in cPanel's DAV daemon just landed with a CVSS score of 8.6. It arrives while threat actors are already targeting cPanel infrastructure through a separate authentication bypass. For hosting providers and system administrators running cPanel and Web Host Manager version 120 or higher, CVE-2026-29205 exposes sensitive server files, including configuration data and credentials, to any remote attacker who can reach the cpdavd service.

Technical Information

The vulnerability lives in cpdavd, the cPanel DAV daemon that handles WebDAV operations, including file attachment downloads. Two distinct flaws combine to make it exploitable.

Root Cause: Privilege Management and Path Filtering

The first flaw is in privilege management. When cpdavd processes a file download request through its attachment download endpoints, it does not properly drop elevated privileges before it reads from the file system. The daemon keeps its higher-level service privileges during file retrieval, so any file accessible to the daemon's process context is fair game. This is classified under CWE-250: Execution with Unnecessary Privileges.

The second flaw is in path filtering. The endpoints that serve attachment downloads do not adequately validate or sanitize the requested file path, and they do not properly neutralize directory traversal sequences. An attacker can use those sequences to escape the intended download directory.

Attack Flow

The exploitation path is straightforward:

1. An external, unauthenticated attacker identifies a cPanel instance running version 120 or higher with the cpdavd service exposed.
2. The attacker crafts a request to one of the cpdavd attachment download endpoints, injecting directory traversal sequences into the file path parameter.
3. The path filtering is insufficient and does not block or sanitize the traversal sequences, so the request can reference files outside the authorized download directory.
4. The daemon has not dropped its elevated privileges before the file read, so it opens the requested file and returns its contents.
5. The attacker receives the contents of arbitrary files on the server, potentially including /etc/shadow, database credentials, API keys, or other sensitive configuration data.

The severity comes from the two flaws together. Path traversal alone, with properly dropped privileges, might limit the attacker to files readable by a restricted user. Privilege retention alone, without path traversal, would confine reads to the intended directory. Together, they grant broad, unauthenticated read access to the file system.

Patch Information

cPanel issued a public patch for CVE-2026-29205 on May 13, 2026. The fix addresses both root causes at once. cPanel corrected the privilege management logic so that the daemon drops to the appropriate restricted user context before it performs any file I/O on the requested path. The patch also adds stricter path filtering and canonicalization to stop directory traversal sequences from escaping the intended download directory.

The fix has shipped on all active cPanel and WHM release branches:

All subsequent builds in each branch also contain the fix. The vulnerability affects cPanel and WHM version 120 and higher, so older branches below 120 are not impacted.

To apply the update and verify it:

/scripts/upcp
/usr/local/cpanel/cpanel -V

The update command typically needs the force flag to make sure it completes. cPanel is closed source, so no source-level diff or commit has been published. The patched binaries distributed through cPanel's update infrastructure are the only delivery mechanism.

Affected Systems and Versions

The vulnerability affects cPanel and Web Host Manager version 120 and higher. These branches are vulnerable if they run below the listed patched versions:

• cPanel & WHM v124 branch: versions prior to 11.124.0.38
• cPanel & WHM v126 branch: versions prior to 11.126.0.59
• cPanel & WHM v130 branch: versions prior to 11.130.0.23
• cPanel & WHM v132 branch: versions prior to 11.132.0.32
• cPanel & WHM v134 branch: versions prior to 11.134.0.26
• cPanel & WHM v136 branch: versions prior to 11.136.0.10
• WP Squared: versions prior to 11.136.1.12

Branches below version 120 are not affected. Any installation where untrusted networks can reach the cpdavd service is at risk.

Vendor Security History

May 2026 has been a busy month for cPanel security disclosures. Alongside CVE-2026-29205, the vendor patched two more vulnerabilities in quick succession:

• CVE-2026-29201: Another arbitrary file read, this time in the feature file loading mechanism, patched on May 8, 2026.
• CVE-2026-29206: An SQL injection in the sqloptimizer script, patched on the same day as CVE-2026-29205.

More serious is a separate authentication bypass, CVE-2026-41940, which multiple threat actors have been actively exploiting. Attackers have used that flaw to mass-exploit vulnerable internet-facing instances, breach servers, deface websites, and deploy ransomware. That level of attacker interest in cPanel infrastructure makes prompt patching of CVE-2026-29205 especially important. With threat actors this focused on the platform, exploit development for newly disclosed cPanel vulnerabilities is likely to move faster.

References

• NVD Entry for CVE-2026-29205
• cPanel Security Advisory: CVE-2026-29205 cPanel & WHM / WP2 Security Update, May 13, 2026
• cPanel Security Advisory: CVE-2026-29201 cPanel & WHM / WP2 Security Update, May 08, 2026
• cPanel Security Advisory: CVE-2026-29206 cPanel & WHM / WP2 Security Update, May 13, 2026
• Help Net Security: Multiple Threat Actors Actively Exploit cPanel Vulnerability (CVE-2026-41940)