CVE-2025-66429
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
Risk Assessment
An attacker could overwrite critical system files and gain root privileges, resulting in full compromise of the hosting server.
Recommendation
Upgrade cPanel to a version later than 132 or apply the vendor's available patches.
Other vulnerabilities in cPanel
See all- CVE-2026-87899Critical
cPanel contains an execution with unnecessary privileges vulnerability that allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-67401Critical
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component.
- CVE-2026-58048Critical
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
- CVE-2026-65643High
Eval injection vulnerability in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
- CVE-2026-58047Medium
HTTP Smuggling in cPanel allows potential leak of credentials.
Original NVD description (English source)
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS