cPanel and WHM Privilege Management Vulnerability Allowing Arbitrary File Read

A vulnerability in cPanel and WHM has been identified, allowing the reading of arbitrary files on the server. This issue arises from incorrect privilege management and inadequate path filtering, which together enable file access through specific cpdavd attachment download endpoints. The vulnerability affects cPanel & WHM versions 120 and higher.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Remediation

Users can update to cPanel & WHM versions 11.124.0.38 and higher, 11.126.0.59 and higher, 11.130.0.23 and higher, 11.132.0.32 and higher, 11.134.0.26 and higher, or 11.136.0.10 and higher. To apply the update, run the command '/scripts/upcp --force' and verify the installation by checking the cPanel version with '/usr/local/cpanel/cpanel -V'.