TI-2026-23322 Aliases CVE-2026-29205 GHSA-cc7w-h7g4-gq6p

Incorrect privileges management and insufficient path filtering allow to read arbitrary…

MEDIUM 54CWE-250Published 2026-05-13 · Updated 2026-05-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.08373 95th percentileScored 2026-11-07

Fix Fixed cPanel (WebPros): 11.136.0.10, 11.134.0.26, 11.132.0.32 +3WP Squared (WebPros): 11.136.1.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WebPros	cPanel	11.136.0.0 to before 11.136.0.10; 11.134.0.0 to before 11.134.0.26; 11.132.0.0 to before 11.132.0.32; 11.130.0.0 to before 11.130.0.23; 11.126.0.0 to before 11.126.0.59; 11.120.0.0 to before 11.124.0.38	11.136.0.10, 11.134.0.26, 11.132.0.32, 11.130.0.23, 11.126.0.59, 11.124.0.38	Patch available	CNA
WebPros	WP Squared	11.120.1.0 to before 11.136.1.12	11.136.1.12	Patch available	CNA

cPanel VendorWebPros Affected 11.136.0.0 to before 11.136.0.10; 11.134.0.0 to before 11.134.0.26; 11.132.0.0 to before 11.132.0.32; 11.130.0.0 to before 11.130.0.23; 11.126.0.0 to before 11.126.0.59; 11.120.0.0 to before 11.124.0.38 Fixed in 11.136.0.10, 11.134.0.26, 11.132.0.32, 11.130.0.23, 11.126.0.59, 11.124.0.38 Patch available CNA
WP Squared VendorWebPros Affected 11.120.1.0 to before 11.136.1.12 Fixed in 11.136.1.12 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:cpanel:cpanel::::::::	120.0.0 to before 124.0.38; 126.0.0 to before 126.0.59; 130.0.0 to before 130.0.23; 130.0.23 to before 130.0.23; 132.0.0 to before 132.0.32; 134.0.0 to before 134.0.26; 136.0.0 to before 136.0.10	Vulnerable	Cpanel
cpe:2.3:a:cpanel:wp_squared::::::wordpress::*	120.1.0 to before 136.1.12	Vulnerable	Cpanel
cpe:2.3:a:cpanel:whm::::::::	120.0.0 to before 124.0.38; 126.0.0 to before 126.0.59; 130.0.0 to before 130.0.23; 132.0.0 to before 132.0.32; 134.0.0 to before 134.0.26; 136.0.0 to before 136.0.10	Vulnerable	Cpanel

cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* Versions 120.0.0 to before 124.0.38; 126.0.0 to before 126.0.59; 130.0.0 to before 130.0.23; 130.0.23 to before 130.0.23; 132.0.0 to before 132.0.32; 134.0.0 to before 134.0.26; 136.0.0 to before 136.0.10 Vulnerable ·Cpanel
cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:* Versions 120.1.0 to before 136.1.12 Vulnerable ·Cpanel
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* Versions 120.0.0 to before 124.0.38; 126.0.0 to before 126.0.59; 130.0.0 to before 130.0.23; 132.0.0 to before 132.0.32; 134.0.0 to before 134.0.26; 136.0.0 to before 136.0.10 Vulnerable ·Cpanel

Remediation

Fix · CNA cPanel (WebPros) Fixed in 11.136.0.10, 11.134.0.26, 11.132.0.32, 11.130.0.23, 11.126.0.59, 11.124.0.38
Fix · CNA WP Squared (WebPros) Fixed in 11.136.1.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-13
WebPros WP Squared 11.136.1.12
5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-25441 Improper sanitization of the `status` query parameter of the `/unprotected/nova_error`…Priority MEDIUM 42
- TI-2026-25440 Improper certificate validation in WebPros cPanelPriority MEDIUM 41
- TI-2026-23323 SQL injection in WebPros cPanelPriority LOW 37
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-29205
2026-10-03 Alias added: GHSA-cc7w-h7g4-gq6p
2026-10-25 EPSS moved to the 90th–95th percentile
2026-11-07 EPSS moved to the 95th–99th percentile

References

Patch 1

https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026

TI-2026-30342 WebPros cPanel and WHM Authentication Bypass via Login Flow KEVCVSS 4.0CRITICAL 9.3
TI-2026-46792 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. CVSS 4.0HIGH 8.7
TI-2025-40383 Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)… CVSS 3.1HIGH 7.5
TI-2026-47685 Deserialization of untrusted data in WebPros WHMCS CVSS 4.0CRITICAL 9.3
TI-2026-23317 Authorization bypass in WebPros Comet Backup CVSS 4.0CRITICAL 9.9
TI-2026-47687 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI… CVSS 4.0CRITICAL 9.2

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences