CVE-2026-29205
HIGH · 8.6Real vuln, withheld PoC, incomplete patches, but not KEV-listed or in-the-wild confirmed.
What: Incorrect privilege management and insufficient path filtering in cPanel's cpdavd attachment download endpoints allow unauthenticated arbitrary file read (CVSS 8.6).
Why it matters: Published yesterday; researchers withheld PoC pending complete patch, noting cPanel's initial fix (11.134.0.26) is incomplete. High CVSS and pre-auth nature drive urgent patching. Not yet KEV-listed but active vendor iteration signals real exploitation risk.
Where it's seen: Vendor advisory circulation, researcher posts flagging incomplete patches, hosting providers amplifying urgency, multilingual security feeds republishing NVD data. One misattribution claiming Apache Cassandra (false).
RISK: HIGH — Pre-auth arbitrary file read affecting cPanel; incomplete initial patch; active researcher concern.
Description
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low