CVE-2026-29205
Analyzed
Analyzed - Analysis Complete
BaseFortify
Vulnerability report for CVE-2026-29205, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-05-13
Last updated on: 2026-08-12
Assigner: HackerOne
Description
Description
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cpanel | cpanel | From 120.0.0 (inc) to 124.0.38 (exc) |
| cpanel | cpanel | From 126.0.0 (inc) to 126.0.59 (exc) |
| cpanel | cpanel | From 130.0.0 (inc) to 130.0.23 (exc) |
| cpanel | cpanel | From 130.0.23 (inc) to 130.0.23 (exc) |
| cpanel | cpanel | From 132.0.0 (inc) to 132.0.32 (exc) |
| cpanel | cpanel | From 134.0.0 (inc) to 134.0.26 (exc) |
| cpanel | cpanel | From 136.0.0 (inc) to 136.0.10 (exc) |
| cpanel | wp_squared | From 120.1.0 (inc) to 136.1.12 (exc) |
| cpanel | whm | From 120.0.0 (inc) to 124.0.38 (exc) |
| cpanel | whm | From 126.0.0 (inc) to 126.0.59 (exc) |
| cpanel | whm | From 130.0.0 (inc) to 130.0.23 (exc) |
| cpanel | whm | From 132.0.0 (inc) to 132.0.32 (exc) |
| cpanel | whm | From 134.0.0 (inc) to 134.0.26 (exc) |
| cpanel | whm | From 136.0.0 (inc) to 136.0.10 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
