8.8 HighCWE-61
CVE-2026-29203
WebPros cPanel vulnerability
WebProscPanel
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
0.5%probability of exploitation in the next 30 days
Higher than 43% of scored CVEs
SeverityCVSS
8.8High
Description NVD
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Sat 9 May · 08:16 UTC | The Hacker News | cPanel fixes bugs enabling code execution or privilege escalation |
| Sun 10 May · 16:21 UTC | Security Affairs | New cPanel vulnerabilities could allow file access and remote code execution |
- New cPanel vulnerabilities could allow file access and remote code executionSecurity Affairs · mentions it in passing
- cPanel fixes bugs enabling code execution or privilege escalationThe Hacker News · first in our coverage · mentions it in passing