Loading vulnerability…
Unsafe Symlink Handling in cPanel Nova Connector chmod Operation
CVE-2026-29203 is an unsafe symlink handling vulnerability in the cPanel Nova plugin, specifically in Cpanel::Nova::Connector during a chmod operation. The vulnerable logic follows symbolic links located at a user-controlled legacy Nova path under the authenticated user’s home directory instead of operating on the intended target safely. By placing a symlink that points to an arbitrary system file or directory and then triggering the affected chmod path, an authenticated cPanel user can cause permission changes to be applied to files or directories outside their intended security boundary. Because the chmod is performed in a privileged context, the flaw can alter permissions on sensitive system resources and break normal trust assumptions about file ownership and access control.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can modify permissions on arbitrary system files or directories. This can produce denial-of-service conditions by rendering critical files inaccessible or improperly writable, and it can also create a path to local privilege escalation if permissions are changed on security-sensitive resources. In shared hosting environments, the flaw materially increases the risk that a low-privileged authenticated account can interfere with host integrity and potentially chain the issue with other weaknesses to obtain broader administrative control.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting untrusted authenticated shell or panel access, closely monitoring for abnormal permission changes, and reviewing user-controlled paths associated with legacy Nova data for unexpected symbolic links. Additional hardening should focus on limiting opportunities for authenticated users to create or manipulate symlinks in locations processed by privileged cPanel components. No complete vendor workaround is currently available in the provided information, so patching remains the primary mitigation.
Patch, then assume compromise.
Upgrade cPanel & WHM and WP Squared to a fixed release. Reported fixed versions include cPanel & WHM 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.117, 11.110.0.116, 11.102.0.41, 11.94.0.30, and 11.86.0.43, as well as WP Squared 11.136.1.10 or later. Administrators should apply the vendor update immediately and verify that systems are running a patched build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.