CVE-2026-105475
HighCVSS 8.7Summary
cPanel contains improper neutralization of a NUL byte, allowing remote attackers to read calendar and contact data of any mail account.
Risk Assessment
An attacker can access confidential calendar and contact data of users, breaching privacy and potentially enabling further social engineering attacks. This may lead to leakage of personal data.
Recommendation
Upgrade cPanel to a version containing the fix for this issue. Review access logs for unusual requests to calendar and contact data.
Other vulnerabilities in cPanel
See all- CVE-2026-105476High
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.
- CVE-2026-87899Critical
cPanel contains an execution with unnecessary privileges vulnerability that allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-67401Critical
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component.
- CVE-2026-58048Critical
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
- CVE-2026-65643High
Eval injection vulnerability in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
- CVE-2026-58047Medium
HTTP Smuggling in cPanel allows potential leak of credentials.
- CVE-2025-66429High
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
Original NVD description (English source)
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS