Skip to main content

cPanel CVE-2026-58047

| EUVDEUVD-2026-51572 MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2026-07-31 hackerone GHSA-j5q7-f555-68qx
Information Disclosure Request Smuggling Cpanel Wp Squared
5.6
CVSS 4.0 · Vendor: hackerone
Share

Severity by source

Vendor (hackerone) PRIMARY
5.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.0 HIGH

AC:H reflects AT:P desync prerequisites; S:C and C:H/I:H capture cross-tenant credential and session impact; UI:R maps from UI:P; no availability impact reported.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Patch available
Jul 31, 2026 - 18:02 EUVD
Analysis Generated
Jul 31, 2026 - 17:19 vuln.today
CVE Published
Jul 31, 2026 - 16:35 cve.org
MEDIUM 5.6

DescriptionCVE.org

HTTP Smuggling in cPanel allows potential leak of credentials.

AnalysisAI

HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify cPanel deployment with front-end proxy
Delivery
Craft ambiguous CL/TE HTTP/1.1 request
Exploit
Submit smuggled request to front-end server
Execution
Back-end prepends attacker payload to victim's next request
Persist
Victim user submits credentials or authenticated session
Impact
Attacker receives leaked credential data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attack requires that the cPanel deployment uses a front-end proxy (e.g., a load balancer or reverse proxy) in front of the cPanel backend application server, with both components speaking HTTP/1.1 and disagreeing on request boundary parsing (the AT:P prerequisite). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 4.0 score of 5.6 (Medium) somewhat undersells the potential real-world impact in multi-tenant deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the internet sends a specially crafted HTTP request with ambiguous Content-Length and Transfer-Encoding headers to a shared cPanel hosting server; the front-end proxy and back-end application parse the boundary differently, causing the attacker's payload to be prepended to the next request submitted by a different tenant user. When that victim user authenticates or submits a form containing credentials, those credentials are captured within the attacker's smuggled response or request context. …
Remediation Upgrade to cPanel version 138 or later, as documented in the official changelog at https://docs.cpanel.net/changelogs/138-change-log; this is the vendor-confirmed fix referenced in the security advisory at https://support.cpanel.net/hc/en-us/articles/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cpanel

View all
CVE-2023-29489 MEDIUM POC
6.1 Apr 27

An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
CVE-2018-16236 MEDIUM POC
6.1 Aug 30

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is

CVE-2020-26108 CRITICAL
9.8 Sep 25

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
CVE-2020-26105 CRITICAL
9.8 Sep 25

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
CVE-2020-26101 CRITICAL
9.8 Sep 25

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
CVE-2020-26100 CRITICAL
9.8 Sep 25

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
CVE-2020-26098 CRITICAL
9.8 Sep 25

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
CVE-2020-10121 CRITICAL
9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
CVE-2020-10119 CRITICAL
9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
CVE-2026-58048 CRITICAL
9.4 Jul 31

Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to p
CVE-2020-10118 CRITICAL
9.1 Mar 17

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
CVE-2020-10117 CRITICAL
9.1 Mar 17

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical sever

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8
CVE-2021-38162 CRITICAL POC
9.4

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-58047 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy