cPanel link-following flaw allows root-owned file writes and privilege escalation
Anyone with an account on a web hosting control panel can take over the server.
Summary
A link resolution flaw before file access in cPanel lets logged-in users write arbitrary root-owned files and escalate privileges.
Affected when
- A logged-in cPanel account
What to do
Update cPanel to a version at or above the fixed releases for its branch (11.138.0.19, 11.136.0.51, 11.134.0.67, 11.110.0.154), and check the vendor advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen