CVE-2026-29205

HIGH

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

StatusAwaiting Analysis

설명

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Score Summary

CVSS Score: 8.6
Version: 3.1
VPI: 94.60
Why this VPI (explainable, experimental)
VPI breakdown
Impact 86.00
Exploitation signal(EPSS top 10%) ×1.10
VPI 94.60
VPI formula vpi-v1
EPSS: 7.2%
(상위 93.6%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Unchanged
High Confidentiality Impact
Low Integrity Impact
Low Availability Impact

Details

Published: 05/13/2026(2 months ago)
Modified: 05/14/2026(2 months ago)
Source: NVD

CWE Weakness Classification

CWE-250
NVD
Secondary

References (1)

NVD
https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026

목록으로

Dashboard

Vulnerabilities

Impact	86.00
Exploitation signal(EPSS top 10%)	×1.10
VPI	94.60