CVE-2026-29205
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Published May 13, 2026 · updated Aug 12, 2026 · cpanel cpanel
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Aug 12, 2026 · NIST NVD
Updated
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Affected
- cpe cpanel/cpanelversion unspecified
- cpe cpanel/whmversion unspecified
- cpe cpanel/wp squaredversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-29205
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-29205
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
nvd.nist.gov