This vulnerability arises from a chmod operation in the cPanel Nova plugin's Cpanel::Nova::Connector that follows symbolic links (CWE-61). An authenticated user can exploit this by creating a symlink in a user-controlled legacy Nova path, causing the chmod call to apply root permissions to arbitrary system files or directories. This behavior can result in denial of service or local privilege escalation. The affected product is WebPros cPanel, with multiple versions impacted. There is no CVSS score assigned and no vendor advisory or patch information currently available.

The vulnerability allows an authenticated cPanel user to escalate privileges locally by setting root permissions on arbitrary files or directories via symlink following. This can disrupt system operations (denial of service) or compromise system integrity by unauthorized permission changes. The impact is limited to authenticated users with access to cPanel and the ability to create symlinks in specific legacy Nova paths.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user capabilities to create symlinks in legacy Nova paths or monitor for suspicious symlink creation if feasible. Avoid applying generic mitigations that are not directly related to this vulnerability.