Incorrect privileges management and insufficient path filtering

CVE-2026-29205 is a pre-auth arbitrary file read in cpdavd on cPanel & WHM / WP Squared caused by a privilege-drop failure plus insufficient path filtering in attachment-download handling. The vendor says it affects cPanel & WHM version 120 and higher; supported fixed builds are 11.124.0.40, 11.126.0.61, 11.130.0.25, 11.132.0.34, 11.134.0.28, 11.136.0.12, and WP Squared 11.136.1.15 and later. Public research shows successful exploitation reads files as root, including targets like /etc/shadow, but only after the attacker creates a specially named maildir path via email delivery.

Vendor HIGH 8.6 is directionally fair on technical impact, but too optimistic on ease at enterprise scale. The chain is unauthenticated and remote, yet it is not a straight-shot web bug: it depends on reachable cpdavd exposure, a valid mailbox guess, accepted SMTP delivery, and the vulnerable attachment path. Those frictions materially shrink the reachable population, so this stays HIGH, not CRITICAL.

Why this verdict

• Downgrade for setup friction: this is not a pure single-request pre-auth bug; the public exploit chain requires a deliverable mailbox guess and SMTP-driven folder creation first.
• Downgrade for reachable population: only deployments with vulnerable cpdavd exposure on the relevant DAV surface are reachable; many enterprises running cPanel do not broadly expose 2079/2080.
• Stayed HIGH because impact is ugly: once the chain lands, the attacker can read arbitrary files as root, which is enough to steal password hashes, API keys, database credentials, and mail content for fast follow-on compromise.

Why not higher?

It is not CRITICAL because the CVSS vector overstates ease in the field. The mailbox-seeding requirement, service-specific exposure, and absence of KEV-backed mass exploitation evidence make this meaningfully less sprayable than a one-packet auth bypass or RCE.

Why not lower?

It should not fall to MEDIUM because the post-condition is still root-scope file disclosure on an internet-facing hosting control plane. Even without direct RCE, the likely follow-on value of stolen secrets is high enough that defenders should treat exposed, affected hosts as serious patch candidates.

1. Restrict DAV ports — Block inbound access to 2079/2080 from the public Internet and limit to trusted admin/VPN networks where business-acceptable. For a HIGH verdict, deploy this within 30 days if you cannot patch immediately; it directly breaks the exploit path at the first step.
2. Disable unused CalDAV/CardDAV exposure — If the environment does not need cpdavd externally, turn off or tightly scope those services. For a HIGH verdict, do this within 30 days because removing the reachable surface is the fastest way to collapse attacker opportunity.
3. Harden inbound mail acceptance — Tighten mailbox validation, alias handling, and recipient acceptance monitoring so unusual plus-addressed probes are easier to detect and less likely to create the required folder structure. Deploy within 30 days as a friction multiplier, not a substitute for the vendor fix.
4. Monitor for odd plus-addressing and DAV requests — Alert on bursts of RCPT TO attempts to synthetic plus-addresses and on encoded traversal-like requests hitting cpdavd. Stand up the detections within 30 days to catch exploit prep and post-disclosure follow-on activity.

Run this on the target cPanel/WP Squared host, not from a scanner workstation. Invoke as sudo bash check-cve-2026-29205.sh; root is preferred so /usr/local/cpanel/cpanel -V and local files are readable, though most installs work with a regular shell account too.

#!/usr/bin/env bash
# check-cve-2026-29205.sh
# Local version-based verifier for cPanel & WHM / WP Squared builds fixed for CVE-2026-29205.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

CPANEL_BIN="/usr/local/cpanel/cpanel"
VERSION_FILE="/usr/local/cpanel/version"

get_version() {
  if [ -x "$CPANEL_BIN" ]; then
    "$CPANEL_BIN" -V 2>/dev/null && return 0
  fi
  if [ -r "$VERSION_FILE" ]; then
    cat "$VERSION_FILE" 2>/dev/null && return 0
  fi
  return 1
}

ver_ge() {
  # returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

VERSION_RAW="$(get_version 2>/dev/null)"
if [ -z "${VERSION_RAW:-}" ]; then
  echo "UNKNOWN - cPanel version not found"
  exit 2
fi

VERSION="$(echo "$VERSION_RAW" | tr -d '[:space:]')"

# Expect versions like 11.134.0.28
IFS='.' read -r MAJOR BRANCH PATCH BUILD EXTRA <<< "$VERSION"
if [ -z "${MAJOR:-}" ] || [ -z "${BRANCH:-}" ] || [ -z "${PATCH:-}" ] || [ -z "${BUILD:-}" ]; then
  echo "UNKNOWN - unrecognized version format: $VERSION"
  exit 2
fi

if [ "$MAJOR" != "11" ]; then
  echo "UNKNOWN - unexpected cPanel major version: $VERSION"
  exit 2
fi

case "$BRANCH" in
  0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52|53|54|55|56|57|58|59|60|61|62|63|64|65|66|67|68|69|70|71|72|73|74|75|76|77|78|79|80|81|82|83|84|85|86|87|88|89|90|91|92|93|94|95|96|97|98|99|100|101|102|103|104|105|106|107|108|109|110|111|112|113|114|115|116|117|118|119)
    echo "PATCHED - not in vendor affected range (affected: 120 and higher)"
    exit 0
    ;;
  120|121|122|123)
    echo "VULNERABLE - affected unsupported branch ($VERSION); upgrade to a supported fixed branch"
    exit 1
    ;;
  124)
    FIX="11.124.0.40"
    ;;
  126)
    FIX="11.126.0.61"
    ;;
  130)
    FIX="11.130.0.25"
    ;;
  132)
    FIX="11.132.0.34"
    ;;
  134)
    FIX="11.134.0.28"
    ;;
  136)
    FIX="11.136.0.12"
    ;;
  *)
    # Vendor states all further versions are patched.
    if [ "$BRANCH" -gt 136 ] 2>/dev/null; then
      echo "PATCHED - newer branch than vendor fixed branches ($VERSION)"
      exit 0
    fi
    echo "UNKNOWN - branch not covered by local logic: $VERSION"
    exit 2
    ;;
esac

if ver_ge "$VERSION" "$FIX"; then
  echo "PATCHED - $VERSION >= $FIX"
  exit 0
else
  echo "VULNERABLE - $VERSION < $FIX"
  exit 1
fi

Sources

1. cPanel vendor advisory for CVE-2026-29205
2. NVD entry
3. GitHub Advisory Database GHSA-cc7w-h7g4-gq6p
4. Searchlight Cyber / Assetnote technical write-up
5. Assetnote cpanel2shell-scanner repository
6. Censys blog on cPanel exposure
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS data and documentation