CVE-2026-29203 PUBLISHED

Assigner: hackerone
Reserved: 04.03.2026 Published: 08.05.2026 Updated: 09.05.2026

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

Product Status

Vendor WebPros
Product cPanel
Versions Default: unaffected
  • affected from 11.136.0.0 to 11.136.0.9 (excl.)
  • affected from 11.134.0.0 to 11.134.0.25 (excl.)
  • affected from 11.132.0.0 to 11.132.0.31 (excl.)
  • affected from 11.130.0.0 to 11.130.0.22 (excl.)
  • affected from 11.126.0.0 to 11.126.0.58 (excl.)
  • affected from 11.124.0.0 to 11.124.0.37 (excl.)
  • affected from 11.118.0.0 to 11.118.0.66 (excl.)
  • affected from 11.110.0.0 to 11.110.0.116 (excl.)
  • affected from 11.110.0.0 to 11.110.0.117 (excl.)
  • affected from 11.102.0.0 to 11.102.0.41 (excl.)
  • affected from 11.94.0.0 to 11.94.0.30 (excl.)
  • affected from 11.86.0.0 to 11.86.0.43 (excl.)
Vendor WebPros
Product cPanel (CentOS 6, CloudLinux 6)
Versions Default: unaffected
  • affected from 11.110.0.0 to 11.110.114 (excl.)
Vendor WebPros
Product WP Squared
Versions Default: unaffected
  • affected from 11.136.1.0 to 11.136.1.10 (excl.)

References

Problem Types

  • CWE-61 UNIX Symbolic Link (Symlink) Following CWE