Loading vulnerability…
Arbitrary File Read in cPanel & WHM feature::LOADFEATUREFILE
CVE-2026-29201 is an arbitrary file read vulnerability in cPanel & WHM caused by insufficient input validation of the feature file name supplied to the feature::LOADFEATUREFILE adminbin call. The vulnerable code fails to properly restrict relative path input, allowing path traversal outside the intended feature file location. An authenticated attacker can supply a crafted relative path as the feature file name and cause the application to read files from unintended locations on the server. The issue affects cPanel & WHM and related WP Squared builds prior to the vendor-fixed releases published on May 8, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to read arbitrary files accessible to the vulnerable component on the server. This can expose sensitive configuration data, credentials, private keys, internal paths, and other information useful for reconnaissance and follow-on attacks. In shared hosting environments, the vulnerability can materially aid lateral movement or chaining with other flaws by disclosing data needed to escalate access or target additional services.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to cPanel/WHM interfaces and related administrative functionality to trusted users and management networks only, enforcing strong authentication, and monitoring for suspicious use of feature-loading functionality and anomalous file access patterns. Review logs for signs of unauthorized file-read activity and investigate potentially exposed secrets. No specific vendor workaround beyond updating is currently available.
Patch, then assume compromise.
Upgrade cPanel & WHM and WP Squared to a vendor-fixed release. Reported fixed versions include cPanel & WHM 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.117, 11.110.0.116 for certain legacy builds, 11.102.0.41, 11.94.0.30, 11.86.0.43, and WP Squared 11.136.1.10 or later. Apply the vendor security update through the normal update channel or force an immediate update using the vendor-recommended update procedure, then verify the installed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.