This vulnerability in WebPros cPanel arises from improper validation of the feature file name parameter in the feature::LOADFEATUREFILE adminbin call. By supplying a relative file path, an attacker can exploit this to read arbitrary files on the system. The issue is classified under CWE-23 (Relative Path Traversal) and affects multiple cPanel versions from 11.86.0.0 through 11.136.0.0. The CVSS v3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the affected system, potentially exposing sensitive information. The confidentiality impact is high, while integrity and availability impacts are lower but present. This can lead to information disclosure that may facilitate further attacks or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor WebPros advisories closely. Until a patch is available, restricting access to the adminbin interface and limiting exposure of vulnerable cPanel versions may reduce risk.