cPanel

cPanel Team Manager API Dir Traversal: Arbitrary File Write, Priv Esc
CVE-2025-66429 8.8 - High - December 11, 2025

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

Directory traversal

CVE-2023-29489: XSS on cPanel <11.109.9999.116 cpsrvd via invalid ID
CVE-2023-29489 6.1 - Medium - April 27, 2023

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.

XSS

cPanel SMTP Password Leak Cleartext Credential Disclosure
CVE-2023-27927 6.5 - Medium - March 27, 2023

An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behind asterisks. The attacker could then perform further attacks using the SMTP credentials.

Cleartext Transmission of Sensitive Information

cPanel Arbitrary File Write via Authenticated Web Interface (CVE-2022-37903)
CVE-2022-37903 8.8 - High - December 12, 2022

A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.

Memory Corruption

In cPanel before 96.0.13
CVE-2021-38589 8.1 - High - August 11, 2021

In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).

In cPanel before 96.0.8, weak permissions on web stats
CVE-2021-38590 5.5 - Medium - August 11, 2021

In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

Incorrect Permission Assignment for Critical Resource

In cPanel before 96.0.13
CVE-2021-38588 8.1 - High - August 11, 2021

In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).

Download of Code Without Integrity Check

In cPanel before 96.0.13
CVE-2021-38587 7.5 - High - August 11, 2021

In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).

Race Condition

The WHM Locale Upload feature in cPanel before 98.0.1
CVE-2021-38585 7.2 - High - August 11, 2021

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

Marshaling, Unmarshaling

The WHM Locale Upload feature in cPanel before 98.0.1
CVE-2021-38584 7.2 - High - August 11, 2021

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

XXE

In cPanel before 98.0.1
CVE-2021-38586 4.4 - Medium - August 11, 2021

In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).

cPanel before 94.0.3
CVE-2021-31803 6.1 - Medium - April 26, 2021

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).

XSS

cPanel before 92.0.9
CVE-2021-26267 7.5 - High - January 26, 2021

cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).

cPanel before 92.0.9
CVE-2021-26266 7.5 - High - January 26, 2021

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).

cPanel before 90.0.17
CVE-2020-29137 6.1 - Medium - November 27, 2020

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).

XSS

In cPanel before 90.0.17, 2FA can be bypassed
CVE-2020-29136 6.5 - Medium - November 27, 2020

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).

Improper Restriction of Excessive Authentication Attempts

cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
CVE-2020-29135 4.1 - Medium - November 27, 2020

cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).

Injection

chsh in cPanel before 88.0.3
CVE-2020-26100 9.8 - Critical - September 25, 2020

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).

cPanel before 90.0.10
CVE-2020-26115 6.1 - Medium - September 25, 2020

cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).

XSS

cPanel before 90.0.10
CVE-2020-26114 6.1 - Medium - September 25, 2020

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).

XSS

cPanel before 90.0.10
CVE-2020-26113 6.1 - Medium - September 25, 2020

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

XSS

The email quota cache in cPanel before 90.0.10
CVE-2020-26112 7.5 - High - September 25, 2020

The email quota cache in cPanel before 90.0.10 allows overwriting of files.

cPanel before 90.0.10
CVE-2020-26111 6.1 - Medium - September 25, 2020

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

XSS

cPanel before 88.0.13
CVE-2020-26110 6.1 - Medium - September 25, 2020

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

XSS

cPanel before 88.0.13 allows bypass of a protection mechanism
CVE-2020-26109 7.5 - High - September 25, 2020

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).

cPanel before 88.0.13 mishandles file-extension dispatching
CVE-2020-26108 9.8 - Critical - September 25, 2020

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).

cPanel before 88.0.3
CVE-2020-26107 7.5 - High - September 25, 2020

cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).

Inadequate Encryption Strength

cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
CVE-2020-26106 7.5 - High - September 25, 2020

cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).

Insertion of Sensitive Information into Log File

In cPanel before 88.0.3
CVE-2020-26105 9.8 - Critical - September 25, 2020

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).

Insufficiently Protected Credentials

In cPanel before 88.0.3
CVE-2020-26104 7.5 - High - September 25, 2020

In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).

Insecure Storage of Sensitive Information

In cPanel before 88.0.3
CVE-2020-26103 7.5 - High - September 25, 2020

In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).

Weak Password Requirements

In cPanel before 88.0.3
CVE-2020-26102 7.5 - High - September 25, 2020

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).

AuthZ

cPanel before 88.0.3
CVE-2020-26099 7.5 - High - September 25, 2020

cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).

cPanel before 88.0.3 mishandles the Exim filter path
CVE-2020-26098 9.8 - Critical - September 25, 2020

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).

In cPanel before 88.0.3
CVE-2020-26101 9.8 - Critical - September 25, 2020

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

Insufficiently Protected Credentials

cPanel before 86.0.14
CVE-2020-12785 - May 11, 2020

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).

cPanel before 86.0.14
CVE-2020-12784 - May 11, 2020

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).

cPanel before 84.0.20
CVE-2020-10121 9.8 - Critical - March 17, 2020

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).

cPanel before 84.0.20
CVE-2020-10120 7.2 - High - March 17, 2020

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).

AuthZ

cPanel before 84.0.20
CVE-2020-10119 9.8 - Critical - March 17, 2020

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

cPanel before 84.0.20
CVE-2020-10118 9.1 - Critical - March 17, 2020

cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
CVE-2020-10117 9.1 - Critical - March 17, 2020

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).

AuthZ

cPanel before 84.0.20
CVE-2020-10116 5.3 - Medium - March 17, 2020

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).

AuthZ

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin
CVE-2020-10115 7.2 - High - March 17, 2020

cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).

Improper Input Validation

cPanel before 84.0.20
CVE-2020-10114 6.1 - Medium - March 17, 2020

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).

XSS

cPanel before 84.0.20
CVE-2020-10113 6.1 - Medium - March 17, 2020

cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).

XSS

cPanel before 82.0.18
CVE-2019-20490 - March 17, 2020

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

cPanel before 82.0.18
CVE-2019-20493 - March 17, 2020

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

cPanel before 82.0.18
CVE-2019-20492 - March 17, 2020

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).

In cPanel before 82.0.18, Cpanel::Rand::Get
CVE-2019-20494 - March 17, 2020

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).