WID-SEC-W-2026-1538

csafDEcert_bund

DeutschShown in its original language — a full translation is planned for a future version.

cPanel cPanel/WHM: Mehrere Schwachstellen

view advisory published 2026-05-14

Ein Angreifer kann mehrere Schwachstellen in cPanel cPanel/WHM ausnutzen, um seine Privilegien zu erhöhen, SQL-Injection mit Root-Rechten durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

01

describes (5)

Related CVEs.

IDseverity exploitable
CVE-2026-32991US—OT elevated—
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.
CVE-2026-29206US——
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
CVE-2026-32993US——
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.
CVE-2026-32992US——
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
CVE-2026-29205US——
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan