EUVD-2026-28810
GHSA-c3fx-j4hr-97w5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Network-reachable adminbin call with low complexity, but invoked from an authenticated cPanel user context (PR:L); pure arbitrary file read yields high confidentiality only, no integrity/availability impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
8DescriptionCVE.org
Insufficient input validation of the feature file name in feature::LOADFEATUREFILE adminbin call can cause arbitrary file read when a relative file path is passed.
AnalysisAI
Arbitrary file read in cPanel & WHM's feature::LOADFEATUREFILE adminbin call allows an attacker to disclose sensitive files by supplying a relative path that bypasses the feature-file name validation. The flaw affects multiple cPanel branches (11.86 through 11.136) as well as WP Squared and the CentOS 6/CloudLinux 6 builds, and was reported responsibly through HackerOne with a vendor patch issued May 8, 2026. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
Technical ContextAI
cPanel's adminbin mechanism is a privilege-separation bridge that lets unprivileged cPanel user processes invoke tightly-scoped administrative helper routines. The feature::LOADFEATUREFILE routine is intended to load a named feature-list file from a fixed directory, but per the description it performs insufficient input validation on the feature file name (CWE-20, Improper Input Validation). By passing a relative path (e.g. directory-traversal sequences), the routine can be coerced into reading files outside the intended feature-file directory, turning a benign 'load this feature list' operation into an arbitrary file read executed with the elevated privileges of the adminbin handler. The CPE data confirms the affected code is present in WebPros cPanel, WP Squared, and the legacy CentOS 6/CloudLinux 6 cPanel builds.
RemediationAI
Apply the vendor patch by upgrading to the fixed release on your branch: cPanel 11.86.0.43, 11.94.0.30, 11.102.0.41, 11.110.0.114/116/117, 11.118.0.66, 11.124.0.37, 11.126.0.58, 11.130.0.22, 11.132.0.31, 11.134.0.25, or 11.136.0.9, and WP Squared 11.136.1.10, per the cPanel Security Update of May 8, 2026 (https://support.cpanel.net/hc/en-us/articles/40311033698327-Security-CVE-2026-29201-cPanel-WHM-WP2-Security-Update-May-08-2026). cPanel typically auto-updates on daily maintenance, so confirm your update tier is set to a release/stable tier that includes the fix rather than a frozen version, and verify the running build afterward. If patching must be delayed, reduce exposure by tightening which tenants have active cPanel accounts and by monitoring adminbin invocations for anomalous feature-file paths; note that adminbin cannot generally be disabled without breaking core cPanel functionality, so avoiding the patch is not a durable option.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to p
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical sever
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today