CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

cPanel/WHM unsafe symlink handling, chmod abuse on arbitrary files (CVSS 8.8, second emergency TSR)

cve · CVE-2026-29203

Coverage
1
first 2026-05-09 → last 2026-10-21
Latest activity
2026-05-10
cPanel patches authenticated Perl code injection (CVE-2026-29202) and two file-permission flaws across cPanel…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
11
5 hosts

Defender insights

What each entry about CVE-2026-29203 tells a defender to do, newest first.

2026-05-10NOTABLEcPanel patches authenticated Perl code injection (CVE-2026-29202) and two file-permission flaws across cPanel & WHM

Exposure · detection

Story timeline

  1. 2026-05-10cPanel & WHM security update of 2026-05-08: CVE-2026-29202 Perl code injection, CVE-2026-29203 symlink chmod and CVE-2026-29201 arbitrary file read
    trending-vulnerabilitiescPanel patches authenticated Perl code injection (CVE-2026-29202) and two file-permission flaws across cPanel & WHM

Hunting pivots

Affected products
WP SquaredcPanel & WHM
Tags
patch-availablercevulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionCommand and Scripting Interpreter
  • Privilege EscalationExploitation for Privilege Escalation
  • CollectionData from Local System

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-05-10/cpanel-whm-second-emergency-tsr-in-10-days-embargo-lifted-on · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-10/cpanel-whm-second-emergency-tsr-in-10-days-embargo-lifted-on · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-05-10/cpanel-whm-second-emergency-tsr-in-10-days-embargo-lifted-on · ATT&CK page ↗

Entries about cPanel/WHM unsafe symlink handling, chmod abuse on arbitrary files (CVSS 8.8, second emergency TSR) (1)

2026-05-10 · view entry permalink →

NOTABLECVE-2026-29202 +2updatedNATOA2

cPanel & WHM security update of 2026-05-08: CVE-2026-29202 Perl code injection, CVE-2026-29203 symlink chmod and CVE-2026-29201 arbitrary file read

cPanel published patches and one advisory per CVE for three cPanel & WHM and WP Squared vulnerabilities on 2026-05-08 (cPanel, CVE-2026-29202). CVE-2026-29202 is a Perl code-injection flaw in the plugin parameter of the create_user API call (cPanel, CVE-2026-29202) that gives arbitrary Perl code execution as the already authenticated account's system user (The Hacker News, 2026-05-09). CVE-2026-29203 is an unsafe symlink handling error that lets a user chmod an arbitrary file, allowing denial of service and possible privilege escalation (cPanel, CVE-2026-29203). CVE-2026-29201 is an arbitrary file read in the feature::LOADFEATUREFILE adminbin call, where a relative path in the feature file name makes an arbitrary file world-readable (cPanel, CVE-2026-29201). The CVE records, as ENISA's EUVD carries them, score CVE-2026-29202 and CVE-2026-29203 at 5.3 under CVSS 4.0 (EUVD-2026-28811; EUVD-2026-28812) and CVE-2026-29201 at 8.6 under CVSS 3.1 with no privileges required (EUVD-2026-28810); The Hacker News reports 8.8, 8.8 and 4.3, and no evidence of exploitation in the wild as of 2026-05-09 (The Hacker News, 2026-05-09).

The fixed releases are cPanel & WHM version 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.117, 11.102.0.41, 11.94.0.30 and 11.86.0.43 or higher, WP Squared version 11.136.1.11 or higher, and version 11.110.0.116 as a direct update for CentOS 6 and CloudLinux 6 (cPanel, CVE-2026-29202). The update followed by ten days cPanel's advisory for CVE-2026-41940, an authentication bypass (cPanel, CVE-2026-41940) that hosting provider KnownHost reported exploited in the wild since 2026-02-23 (SecurityWeek, 2026-04-30); Shadowserver counted at least 44,000 IP addresses likely compromised through it scanning its honeypots on 2026-04-30 (The Hacker News, 2026-05-04).

A Perl code injection method was found in the create_user API call, relating to the plugin parameter.

cPanel (CVE-2026-29202 advisory) 2026-05-08

An unsafe symlink handling error was found that allows a user to chmod an arbitrary file, allowing for denial of service and possible privilege escalation.

cPanel (CVE-2026-29203 advisory) 2026-05-08

A relative path may be passed as the argument to this call, causing an arbitrary file to be made world-readable.

cPanel (CVE-2026-29201 advisory) 2026-05-08

that could result in arbitrary Perl code execution on behalf of the already authenticated account's system user.

While there is no evidence that the vulnerabilities have been exploited in the wild

Per data from the Shadowserver Foundation, at least 44,000 IP addresses likely compromised via CVE-2026-41940 are said to have

The Hacker News 2026-05-09
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationcvesevent_dateevidenceheadlineprioritysourcessourcing_notesummarytechniquestitle

The CVE records, as ENISA's EUVD carries them, score 5.3 under CVSS 4.0 for CVE-2026-29202 and CVE-2026-29203 (EUVD-2026-28811; EUVD-2026-28812) and 8.6 under CVSS 3.1 for CVE-2026-29201 (EUVD-2026-28810); the 8.8, 8.8 and 4.3 figures are The Hacker News's (The Hacker News, 2026-05-09). Only CVE-2026-29202 yields code execution: CVE-2026-29203 lets a user chmod an arbitrary file (cPanel, CVE-2026-29203) and CVE-2026-29201 makes an arbitrary file world-readable (cPanel, CVE-2026-29201). The patch and the advisories were published together on 2026-05-08, and the fix covers eleven cPanel & WHM branches from 11.86 to 11.136 and WP Squared, not three (cPanel, CVE-2026-29202). For CVE-2026-41940, Shadowserver counted at least 44,000 likely compromised IP addresses scanning its honeypots on 2026-04-30 (The Hacker News, 2026-05-04), and KnownHost reported exploitation since 2026-02-23 (SecurityWeek, 2026-04-30); no source describes attackers chaining it with CVE-2026-29202.

vulnerability10 May 05:00Zmulti-sourceOpen finding →
Sources: The Hacker News · NCSC-CH Security Hub post 12550 · cPanel (CVE-2026-29202 advisory) · cPanel (CVE-2026-29203 advisory) · cPanel (CVE-2026-29201 advisory) · ENISA EUVD (EUVD-2026-28811, CVE-2026-29202) · ENISA EUVD (EUVD-2026-28812, CVE-2026-29203) · ENISA EUVD (EUVD-2026-28810, CVE-2026-29201) · cPanel (CVE-2026-41940 advisory) · SecurityWeek

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • support.cpanel.net4 (36%)
  • euvd.enisa.europa.eu3 (27%)
  • thehackernews.com2 (18%)
  • security-hub.ncsc.admin.ch1 (9%)
  • securityweek.com1 (9%)

External references

NVD · cve.org · CISA KEV

All cited sources (11)