Arbitrary File Read in cPanel cpdavd Attachment Download Endpoints

Successful exploitation allows unauthorized reading of arbitrary files on the server, resulting in high confidentiality impact. Based on the provided context, exploitation is possible remotely over the network without authentication or user interaction. Because the flaw involves incorrect privilege handling in cpdavd, the attacker may obtain access to files readable with elevated privileges, including potentially sensitive system or application data. The supplied CVSS vector also indicates low integrity and availability impact, though the primary consequence described is unauthorized disclosure of server-side files.

If immediate patching is not possible, reduce exposure to the vulnerable cpdavd attachment download endpoints by restricting network access to trusted administrative sources, placing the service behind access controls or filtering, and monitoring for suspicious requests targeting attachment download functionality. Because the provided content does not include vendor-specific temporary workarounds, definitive mitigation guidance beyond limiting exposure and accelerating patch deployment is currently not available.

Apply the cPanel & WHM security update referenced in the vendor advisory for CVE-2026-29205, identified in the provided content as the WP2 Security Update dated May 13, 2026. Upgrade affected cPanel & WHM installations to a vendor-fixed release that corrects the privilege management and path filtering flaws in the cpdavd attachment download endpoints.