Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-29201

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WebPros cPanel

Default version status: unaffected

  • 11.136.0.0 to < 11.136.0.9affected
  • 11.134.0.0 to < 11.134.0.25affected
  • 11.132.0.0 to < 11.132.0.31affected
  • 11.130.0.0 to < 11.130.0.22affected
  • 11.126.0.0 to < 11.126.0.58affected
  • 11.124.0.0 to < 11.124.0.37affected
  • 11.118.0.0 to < 11.118.0.66affected
  • 11.110.0.0 to < 11.110.0.117affected
  • 11.102.0.0 to < 11.102.0.41affected
  • 11.94.0.0 to < 11.94.0.30affected
  • 11.86.0.0 to < 11.86.0.43affected

WebPros WP Squared

Default version status: unaffected

  • 11.136.1.0 to < 11.136.1.11affected

WebPros cPanel (CloudLinux 6, CentOS 6)

Default version status: unaffected

  • 11.110.0.0 to < 11.110.0.116affected

References