This vulnerability arises from improper input validation (CWE-20) in the WebPros cPanel product. Specifically, the feature file name parameter in the `feature::LOADFEATUREFILE` administrative binary call does not properly validate input, enabling an attacker to read arbitrary files by supplying relative file paths. Multiple versions of cPanel prior to and including 11.136.0.0 are affected. No official patch or remediation guidance is currently documented, and no public exploits have been observed.

Successful exploitation allows an attacker to read arbitrary files on the affected system, potentially exposing sensitive configuration or credential data. This can lead to information disclosure but does not directly indicate code execution or privilege escalation. The impact depends on the files accessible via the relative path traversal.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative interface to trusted users only and monitor for suspicious activity related to file access attempts involving the `feature::LOADFEATUREFILE` call. Avoid exposing cPanel admin interfaces to untrusted networks.