PT-2026-40436 · Cpdavd · Cpdavd

CVE-2026-29205 · Published 2026-04-04 · Updated 2026-07-12

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions cPanel (affected versions not specified)

Description A pre-authentication path traversal issue exists in the cpdavd service of cPanel and WordPress Squared, as well as WebHost Manager. This flaw results from incorrect privileges management and insufficient path filtering within the cpdavd attachment download endpoints. An attacker can exploit this by abusing Dovecot's + alias handling to create attacker-controlled directory names on disk, allowing the remote reading of arbitrary files on the server with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-250

CWE-22

Related Identifiers

BDU:2026-07107

CVE-2026-29205

Affected Products

Cpdavd

References · 24

• https://bdu.fstec.ru/vul/2026-07107 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29205 · Security Note
• https://twitter.com/lyrie_ai/status/2069620574645567579 · Twitter Post
• https://t.me/secharvester/22513 · Telegram Post
• https://t.me/defcon_news/135788 · Telegram Post
• https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026 · Note
• https://t.me/CSIRT_italia/3544 · Telegram Post
• https://twitter.com/cyberatlas_ai/status/2076301450376777901 · Twitter Post
• https://slcyber.io/research-center/new-age-of-collisions-reading-arbitrary-files-pre-auth-as-root-in-cpanel-cve-2026-29205 · Note
• https://twitter.com/infosec_au/status/2054749885258449252 · Twitter Post
• https://twitter.com/N45HTOfficial/status/2056413417150575011 · Twitter Post
• https://twitter.com/lyrie_ai/status/2069620572426830020 · Twitter Post
• https://twitter.com/KenBrubacher/status/2054404585570095283 · Twitter Post
• https://twitter.com/CCBalert/status/2056372492214612252 · Twitter Post
• https://twitter.com/CVEnew/status/2054709176488935634 · Twitter Post