PT-2025-50728 · Cpanel · Cpanel

Published 2025-11-05 · Updated 2025-12-14 · CVE-2025-66429

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cPanel versions 110 through 132

Description A directory traversal issue exists within the Team Manager API. This allows for the overwriting of arbitrary files, potentially leading to privilege escalation to the root user.

Recommendations Update to a version beyond 132.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-00905

CVE-2025-66429

Affected Products

Cpanel

References · 13

• https://bdu.fstec.ru/vul/2026-00905 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66429 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66429 · Vendor Advisory
• https://docs.cpanel.net/changelogs/130-change-log · Note
• https://anti-malware.ru/news/2025-12-25-111332/48572?ysclid=mkxxp0zgj2586858800 · Note
• https://infinitsec.net/posts/cve-2025-66429-cpanel-directory-traversal-privilege-escalation · Reddit Post
• https://docs.cpanel.net/release-notes/release-notes · Note
• https://t.me/secharvester/20869 · Telegram Post
• https://vuldb.com/?id.335958 · Note
• https://twitter.com/CVEnew/status/2000246189472596239 · Twitter Post
• https://docs.cpanel.net/changelogs/132-change-log · Note
• https://support.cpanel.net/hc/en-us/articles/36417624514455-Local-Privilege-Escalation-Vulnerability-using-the-Team-Manager-API-CVE-2025-66429 · Note
• https://docs.cpanel.net/changelogs/126-change-log · Note