EUVD-2026-28812
GHSA-3x6m-3grh-599c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Symlink placement is a local filesystem operation (AV:L); authenticated cPanel account required (PR:L); root chmod crosses security scope to system files (S:C); no direct confidentiality impact but high integrity and availability consequences.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
AnalysisAI
Symlink following in cPanel's Nova plugin (Cpanel::Nova::Connector) allows any authenticated cPanel user to redirect a root-executed chmod to arbitrary filesystem paths by placing a symlink at a user-controlled legacy Nova path within their home directory. Affected are more than a dozen cPanel release trains spanning versions 11.86 through 11.136, plus WP Squared 11.136.x. No public exploit exists and EPSS stands at 0.04%, but CISA's SSVC framework rates the technical impact as total given the potential to set root-level permissions on critical system files, enabling local privilege escalation or denial of service in multi-tenant hosting environments.
Technical ContextAI
The vulnerable component is Cpanel::Nova::Connector, a Perl module within the cPanel Nova plugin maintained by WebPros. CWE-61 (UNIX Symbolic Link Following) describes the root cause: the connector performs a chmod() syscall on a filesystem path derived from the user's home directory - specifically a 'legacy Nova path' - without first resolving or verifying that the path is not a symbolic link. Because the Nova plugin executes this chmod with root privileges, a user-supplied symlink redirects the operation to any arbitrary target on the filesystem, such as /etc/shadow or /etc/sudoers. CPE data confirms three distinct affected product lines: cpe:2.3:a:webpros:cpanel:*:*:*:*:*:*:*:*, cpe:2.3:a:webpros:cpanel_(centos_6,_cloudlinux_6):*:*:*:*:*:*:*:*, and cpe:2.3:a:webpros:wp_squared:*:*:*:*:*:*:*:*. This is a classic TOCTOU-adjacent pattern where the privilege boundary between user space and root-executed code is crossed via filesystem indirection rather than code injection.
RemediationAI
The primary fix is to upgrade to a patched release from WebPros. Per EUVD-2026-28812 and the vendor advisory, patched versions are: cPanel 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.117 (or 11.110.114 for CentOS 6/CloudLinux 6 deployments), 11.102.0.41, 11.94.0.30, and 11.86.0.43; WP Squared users should upgrade to 11.136.1.10. The full advisory is at https://support.cpanel.net/hc/en-us/articles/40311543760407-Security-CVE-2026-29203-cPanel-WHM-WP2-Security-Update-May-08-2026. If immediate patching is not feasible, disabling the legacy Nova feature or revoking shell/SFTP access for untrusted cPanel accounts reduces exposure by preventing symlink placement; note that disabling shell access may break legitimate user workflows and should be tested in staging. Restricting which filesystem paths the Nova connector processes at the application level (allowlisting resolved real paths) would be the proper defense-in-depth measure pending a patch.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection fla
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to p
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today