Read the docs
TI-2026-84116 Aliases CVE-2026-105475GHSA-rcwx-58mq-xwr6

cPanel NUL byte flaw exposes mail account calendars and contacts

Priority MEDIUM 44CWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper neutralization of a NUL byte in WebPros cPanel versions from 0 before 11.138.0.19, from 0 before 11.136.0.51, from 0 before 11.134.0.67 and from 0 before 11.110.0.154 (CWE-158) lets a remote attacker without authentication read calendar and contact data of any mail account. The attack is low in complexity and requires no user interaction, and it impacts confidentiality only (CVSS 4.0 base score 8.7).

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Fixed cPanel (WebPros): 11.138.0.19, 11.136.0.51, 11.134.0.67 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WebProscPanelbefore 11.138.0.19; before 11.136.0.51; before 11.134.0.67; before 11.110.0.15411.138.0.19, 11.136.0.51, 11.134.0.67, 11.110.0.154Patch availableCNA
  • cPanel VendorWebPros Affected before 11.138.0.19; before 11.136.0.51; before 11.134.0.67; before 11.110.0.154 Fixed in 11.138.0.19, 11.136.0.51, 11.134.0.67, 11.110.0.154 Patch available CNA

Remediation

Upgrade cPanel to 11.138.0.19, 11.136.0.51, 11.134.0.67 or 11.110.0.154.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA cPanel (WebPros) Fixed in 11.138.0.19, 11.136.0.51, 11.134.0.67, 11.110.0.154

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WebPros cPanel 11.110.0.154, 11.134.0.67 and 2 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-84117 Improper link resolution in cPanel allows writing root-owned filesPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-105475
  2. 2026-11-02 CISA SSVC decision points changed
  3. 2026-11-02 Alias added: GHSA-rcwx-58mq-xwr6

References

Other 1

  • TI-2026-30342 WebPros cPanel and WHM Authentication Bypass via Login Flow KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-46792 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. CVSS 4.0HIGH 8.7
  • TI-2025-40383 Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)… CVSS 3.1HIGH 7.5
  • TI-2026-23322 Incorrect privileges management and insufficient path filtering allow to read arbitrary… CVSS 3.1HIGH 8.6
  • TI-2026-47685 Deserialization of untrusted data in WebPros WHMCS CVSS 4.0CRITICAL 9.3
  • TI-2026-23317 Authorization bypass in WebPros Comet Backup CVSS 4.0CRITICAL 9.9
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences