cPanel vulnerabilities
We track 4 vulnerabilities in cPanel products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 13, 2026.
Latest cPanel vulnerabilities
- 8.2 High severity
cPanel: Improper Certificate Validation
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
- 8.6 High severity
cPanel: Execution with Unnecessary Privileges
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
- 8.8 High severity
Cpanel: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
- 9.1 Critical severity
cpanel: Out-of-bounds Read
The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.