# CVE-2026-29203: cPanel Nova plugin symlink following in Cpanel::Nova::Connector

Source: https://junglewise.ai/threats/cve-2026-29203-cpanel-nova-plugin-symlink-following-in-cpanel-nova-connector  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-29203 · Severity: high · CVSS 8.8 · Published 2026-05-08

A vulnerability in the cPanel Nova plugin allows an authorized user to gain administrative control over the entire server. By creating a malicious link within their own directory, a user can trick the system into changing the permissions of critical system files. This can lead to a total system takeover, data theft, or a complete shutdown of services.

Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-29203 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29203 being exploited in the wild.

**How severe is CVE-2026-29203?** High severity, with a CVSS score of 8.8, published 8 May 2026.

**Which products and versions are affected?** cPanel Nova plugin.

**Is there a fix for CVE-2026-29203?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-29203 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-29203?** Check whether you run cPanel Nova plugin. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a symbolic link (symlink) following issue (CWE-61) within the Cpanel::Nova::Connector component of the cPanel Nova plugin. The root cause is an insecure 'chmod' operation that fails to validate if the target path is a symlink before execution. An authenticated cPanel user can exploit this by placing a symlink at a specific legacy Nova path within their home directory that points to a sensitive system file or directory. When the plugin performs its routine operations, it follows the symlink and applies permission changes to the target file with root privileges. This allows the attacker to achieve local privilege escalation or cause a Denial of Service (DoS) by corrupting system file permissions. cPanel has released a security update to address this issue.

## Affected products

- cPanel Nova plugin

## Timeline

- 2026-05-08: advisory: Initial disclosure by cPanel and NVD publication

## References

- [https://support.cpanel.net/hc/en-us/articles/40311543760407-Security-CVE-2026-29203-cPanel-WHM-WP2-Security-Update-May-08-2026](https://support.cpanel.net/hc/en-us/articles/40311543760407-Security-CVE-2026-29203-cPanel-WHM-WP2-Security-Update-May-08-2026)