CVE-2025-66429

EUVD-2025-202876
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
Affected Products (NVD)
VendorProductVersion
cpanelcpanel
110.0.0 ≤
𝑥
< 126.0.37
cpanelcpanel
128.0.1 ≤
𝑥
< 130.0.16
cpanelcpanel
132.0.0 ≤
𝑥
< 132.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://docs.cpanel.net/changelogs/126-change-log/
https://docs.cpanel.net/release-notes/release-notes/