Back to Security Advisories

Security: CVE-2026-29205 – cPanel & WHM / WP2 Security Update – May 13, 2026

Through a combination of incorrect dropping of privileges and insufficient path filtering, it was possible to read arbitrary files via certain cpdavd endpoints. This affects cPanel & WHM versions 120 and higher.

High 8.6 CVSS
cPanel

Default Update CMD

sudo /scripts/upcp --force

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a vulnerability in cPanel software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell cPanel under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

Situation

Through a combination of incorrect dropping of privileges and insufficient path filtering, it was possible to read arbitrary files via certain cpdavd endpoints. This affects cPanel & WHM versions 120 and higher.

We would like to thank Shubham Shah, Adam Kues, and Patrik Grobshäuser from Assetnote for identifying and responsibly reporting this vulnerability to us.

Impact

We have released a new patch that expands upon the previous release from May 13th. We recommend updating your servers once more and confirming that you are on one of the following versions:

  • 11.124.0.40 and higher
  • 11.126.0.61 and higher
  • 11.130.0.25 and higher
  • 11.132.0.34 and higher
  • 11.134.0.28 and higher
  • 11.136.0.12 and higher

We have also pushed out a patch in the following WP Squared version:

  • 11.136.1.15 and higher

Note: All further versions of cPanel are patched for this issue as well. Please see the latest changelogs for version information of each cPanel branch:
https://docs.cpanel.net/changelogs/

Call to Action

  1. Update the cPanel version on the server to one of the versions listed above. This can be done with the following:

    # /scripts/upcp –force

  2. Once completed, verify the cPanel version with the following to ensure the update was successful.

    # /usr/local/cpanel/cpanel -V

  3. If you are not able to update, then it is recommended that you block inbound traffic on ports 2079 and 2080 at the firewall until you are able to proceed with the upgrade.

Additional Information

Additional security incidents are resolved in this latest release as well. Please see the following for more information:

Frequently Asked Questions

What is CVE-2026-29205?
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
Is CVE-2026-29205 being exploited in the wild?
No confirmed exploitation is recorded. The EPSS model estimates a 8.15% probability of exploitation within the next 30 days — patch on your normal schedule.
How do I fix CVE-2026-29205?
Update cPanel to the patched release.Then confirm the running version matches the patched release listed above.
Why does this advisory list several CVEs?
One vendor release fixed multiple vulnerabilities. This advisory covers CVE-2026-29205, CVE-2026-29206, CVE-2026-32991, CVE-2026-32992, CVE-2026-32993 — updating to the patched release resolves all of them at once.

References

Security Advisories

Related Advisories

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

ConfigServer Security & Firewall (CSF) 16.32-1 — cPanel & WHM Update

2026-09-30

Sitejet Builder 4.13.1-1 — cPanel & WHM Update

2026-09-30

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System