This vulnerability (CVE-2026-29205) in WebPros cPanel arises from improper privilege management and inadequate path filtering in the cpdavd attachment download endpoints. It enables unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information. The issue affects several versions of cPanel including 11.120.0.0 through 11.136.0.0. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with partial integrity and availability impact. No vendor advisory or patch information is currently provided, and the vulnerability is not related to a cloud service.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server running affected versions of cPanel. This can lead to disclosure of sensitive data, partial integrity loss, and partial availability impact. The high CVSS score reflects the severity of these impacts. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the cpdavd attachment download endpoints and monitor for unusual access patterns. Avoid exposing vulnerable cPanel versions to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.