Vulnerability intelligence
CVE-2026-29203
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
CVSS Score
8.8
High
EPSS — Exploit Probability
0.5%
Riskier than 39% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
2 articles across 2 outlets · first covered May 9, 2026 · latest May 10, 2026
Coverage timeline
-
New cPanel vulnerabilities could allow file access and remote code executionsecurityaffairs.com · May 10, 2026
-
cPanel fixes bugs enabling code execution or privilege escalationthehackernews.com · May 9, 2026