Executive brief
A security vulnerability in cPanel & WHM could allow an authenticated user to access files they should not be able to see. This occurs due to improper checks when the system handles specific administrative requests for feature files. An attacker could exploit this to read sensitive configuration or system files, potentially leading to further unauthorized access or data exposure.
Technical details
An arbitrary file read vulnerability exists in cPanel & WHM's AdminBin component. The root cause is insufficient input validation within the `feature::LOADFEATUREFILE` call, which fails to properly sanitize or restrict relative file paths. An authenticated attacker with network access can provide a crafted file path to read arbitrary files on the filesystem that the service has permissions to access. The vulnerability is tracked as CWE-20 (Improper Input Validation). A security update was released by cPanel on May 8, 2026, to address this issue.
Affected products
- cPanel cPanel & WHM
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched