# CVE-2026-105476: cPanel symlink resolution race condition allows arbitrary root file write

Source: https://junglewise.ai/threats/cve-2026-105476-improper-link-resolution-before-file-access-in-cpanel-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-105476 · Severity: info · Published 2026-11-02

cPanel is a web hosting management system used by hosting providers to manage customer accounts and server settings. An authenticated user with access to cPanel can exploit a symlink race condition to write files as the root user, potentially compromising the entire server and gaining administrative privileges over all hosted accounts.

Technologies: [cPanel](https://junglewise.ai/threats/technologies/cpanel-cpanel), [cPanel Whm](https://junglewise.ai/threats/technologies/cpanel-whm-1). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-105476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105476 being exploited in the wild.

**How severe is CVE-2026-105476?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** cPanel cPanel; cPanel WHM.

**Is there a fix for CVE-2026-105476?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105476 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105476?** Check whether you run cPanel or cPanel Whm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper symlink resolution before file access operations, allowing time-of-check-time-of-use (TOCTOU) attacks. An authenticated attacker can create symlinks pointing to arbitrary system files and trigger cPanel operations that follow those symlinks to write root-owned files. This enables privilege escalation from a user account to root.

## Affected products

- cPanel cPanel
- cPanel WHM

## Timeline

- 2026-11-02: disclosed

## References

- [https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026](https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026)

## Related threats

- [cPanel NUL byte injection in calendar and contact access](https://junglewise.ai/threats/cve-2026-105475-improper-neutralization-of-a-nul-byte-in-cpanel-allows-remote)
- [cPanel WHM stored XSS in Mass Modify Accounts](https://junglewise.ai/threats/cve-2026-93697-there-is-a-stored-xss-vulnerability-allowing-arbitrary-code)
- [cPanel WHM stored XSS in Manage SSL Hosts](https://junglewise.ai/threats/cve-2026-93029-there-is-a-stored-xss-vulnerability-allowing-arbitrary-code)
- [cPanel privilege escalation allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-87899-execution-with-unnecessary-privileges-in-cpanel-allows-remote)
- [cPanel permission assignment information disclosure in CalDAV/CardDAV](https://junglewise.ai/threats/cve-2026-68490-incorrect-permission-assignment-allows-local-users-to-obtain)