CVE-2026-2920[1-3] cPanel w/ PoC

cR0w · May 18, 2026, 2:34pm

Arbitrary File Read:

https://support.cpanel.net/hc/en-us/articles/40311033698327-Security-CVE-2026-29201-cPanel-WHM-WP2-Security-Update-May-08-2026

Code Injection:

https://support.cpanel.net/hc/en-us/articles/40311426610327-Security-CVE-2026-29202-cPanel-WHM-WP2-Security-Update-May-08-2026

CVE-2026-29202 Code Injection PoC:

github.com/mtotg/vulnerability-pocs

webpros/cpanel/cve-2026-29202.md

main

# cPanel by WebPros

## Code Injection

**Date Reported:** 2026-04-30 8:28 AM ET

**Acknowledged:** 2026-04-30 8:58 AM ET

**Confirmed Issue:** 2026-04-30 4:47 PM ET

**Patch Available:** 2026-05-08 12:00 PM ET

**CVE:** CVE-2026-29202

**cPanel Advisory:** https://support.cpanel.net/hc/en-us/articles/40311426610327-Security-CVE-2026-29202-cPanel-WHM-WP2-Security-Update-May-08-2026

## The Core Issue

A code injection in the `create_user` API call allows any abritrary code to be injected, alongside achieving a full remote shell that, if the provider runs CloudLinux, escapes the CloudLinux jail entirely due to how UAPI runs and is executed. This can be chained with other vulnerabilities such as CVE-2026-29201 for full system takeover.

This file has been truncated. show original

Unsafe Symlink Handling:

https://support.cpanel.net/hc/en-us/articles/40311543760407-Security-CVE-2026-29203-cPanel-WHM-WP2-Security-Update-May-08-2026