PT-2026-40436 · Cpdavd · Cpdavd

Published 2026-05-12 · Updated 2026-05-14 · CVE-2026-29205

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.134.0.26

Description Incorrect privileges management and insufficient path filtering allow an attacker to read arbitrary files on the server via the 'cpdavd attachment download' endpoints.

Recommendations Update to a version later than 11.134.0.26.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2026-29205

Affected Products

Cpdavd

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-29205 · Security Note
• https://reddit.com/r/cpanel/comments/1tbcbv3/and_again_new_vulnerabilities · Reddit Post
• https://reddit.com/r/interserver/comments/1tbe70x/cpanel_whm_targeted_security_release_patch · Reddit Post
• https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026 · Note
• https://twitter.com/infosec_au/status/2054749885258449252 · Twitter Post
• https://twitter.com/KenBrubacher/status/2054404585570095283 · Twitter Post
• https://twitter.com/CVEnew/status/2054709176488935634 · Twitter Post