cPanel & WHM CVE-2026-29205

No special conditions - remote unauthenticated exploitation against default configurations of cPanel & WHM (and WP Squared) servers running the cpdavd daemon, which is enabled by default to provide WebDAV/CalDAV/CardDAV services. The only prerequisites are network reachability to the cpdavd attachment download endpoints and a vulnerable version within the listed ranges; no user interaction, authentication, or non-default settings are required (CVSS PR:N/UI:N/AC:L). Limiting factors: targets must expose cpdavd to the attacker (commonly internet-facing on hosting providers but sometimes firewalled in private deployments), and the file-read is bounded by the privileges of the cpdavd process rather than full root, which may exclude some highly restricted files.

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates a trivially reachable network-based attack with no authentication or user interaction, and the scope-unchanged C:H/I:L/A:L impact reflects high confidentiality loss with limited integrity and availability effects - consistent with an arbitrary file read primitive. SSVC inputs reinforce this: exploitation is currently 'none', but the issue is marked Automatable=yes with Technical Impact=partial, meaning a working exploit would scale across cPanel's large hosting footprint. Counterbalancing this, EPSS is very low (0.04%, 13th percentile) and the CVE is not in CISA KEV, suggesting no observed mass exploitation yet. The Tags field labels this as 'Privilege Escalation', which appears inconsistent with a file-read (C:H/I:L) impact profile and the CWE-250 root cause - defenders should treat this primarily as an information disclosure issue while watching for chained privilege escalation via leaked credentials or keys.

A remote attacker scans the internet for exposed cPanel servers on the cpdavd port and issues an unauthenticated HTTP request to an attachment download endpoint, supplying a crafted path parameter that escapes the intended attachment directory. The server, running cpdavd with elevated privileges and lacking proper path filtering, returns the contents of a sensitive file such as configuration files, MySQL credentials, or private keys. No public proof-of-concept has been identified at time of analysis, but the issue is rated Automatable by SSVC, so scanning-and-harvesting campaigns are plausible once exploit details surface.