CVE-2026-29205

Name of the Vulnerable Software and Affected Versions cPanel (affected versions not specified)

Description Insufficient path filtering and incorrect privileges management in the cpdavd service allow a remote, unauthenticated attacker to read arbitrary files on the server as root. This path traversal issue is exploitable via the cpdavd attachment download endpoints. The attack can be facilitated by abusing Dovecot's + alias handling to create attacker-controlled directory names on the disk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.