cPanel CVE-2026-29201

Exploitation specifically requires reaching the feature::LOADFEATUREFILE adminbin call and supplying a relative (traversal) file path where a plain feature-file name is expected; the bug triggers only because that name is not properly validated. Although the published CVSS uses PR:N, adminbin routines are normally driven from an authenticated cPanel user context, so realistic exploitation likely requires a valid cPanel account on the server - a significant limiting factor that narrows the threat to malicious or compromised tenants rather than anonymous internet attackers. Only vulnerable versions below the fixed builds listed in the advisory are affected; impact is limited to file disclosure (the CVSS I:L/A:L reflect only minor integrity/availability side effects).

The signals are mixed and should be read carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:L, score 8.6) rates this network-reachable, low-complexity, and unauthenticated with high confidentiality impact - a serious profile. However, adminbin calls are structurally invoked from within an authenticated cPanel user session, so PR:N is questionable and real-world exploitation more plausibly requires at least a valid low-privilege cPanel account; this discrepancy should be verified with the vendor. Corroborating the lower real-world urgency, EPSS is only 0.04% (12th percentile), CISA SSVC marks Exploitation as 'none', Automatable 'no', and Technical Impact 'partial', and there is no public exploit or KEV listing. Net assessment: a legitimately impactful information-disclosure bug worth patching promptly on any multi-tenant hosting server, but not an emergency mass-exploitation scenario - the more likely threat model is a malicious or compromised tenant reading other users' or system files.

A low-privilege tenant on a shared cPanel hosting server invokes the feature::LOADFEATUREFILE adminbin call with a crafted relative/traversal path instead of a legitimate feature-file name. The validation gap causes the elevated handler to read and return a file outside the feature directory - for example another account's data or a system configuration file - leaking sensitive information. No public exploit code exists at time of analysis, but the low attack complexity makes weaponization straightforward for someone with account access.