CVE-2026-29201: Path Traversal Vulnerability Explained

CVE-2026-29201 Overview

CVE-2026-29201 is a path traversal vulnerability in the feature::LOADFEATUREFILE adminbin call within cPanel WHM. The flaw stems from insufficient input validation of the feature file name parameter. An attacker who supplies a relative file path can coerce the adminbin into reading arbitrary files from the underlying system. Because adminbin calls execute with elevated privileges, the read can return contents of files normally inaccessible to the caller. The issue is classified under [CWE-23] Relative Path Traversal and was disclosed in the cPanel WHM WP2 Security Update on May 08, 2026.

Critical Impact
Remote attackers can read sensitive files on cPanel WHM servers by passing relative paths to the feature::LOADFEATUREFILE adminbin call, exposing configuration, credential, and system data.

Affected Products

cPanel WHM (WP2 release train)
Installations exposing the feature::LOADFEATUREFILE adminbin handler
Versions prior to the May 08, 2026 security update

Discovery Timeline

2026-05-08 - cPanel releases security update addressing CVE-2026-29201
2026-05-08 - CVE-2026-29201 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-29201

Vulnerability Analysis

The vulnerability resides in the feature::LOADFEATUREFILE adminbin call, a privileged helper used by cPanel WHM to load feature definition files. The handler accepts a file name argument from the caller and uses it to locate and read a feature file on disk. The handler does not sufficiently validate the supplied name, allowing relative path components such as ../ sequences to escape the expected feature file directory. When the adminbin resolves the resulting path, it reads whichever file the traversal points to and returns its contents to the caller. Adminbin calls run with elevated privileges, so the read succeeds even against files restricted from the calling user. The attack is reachable over the network without authentication or user interaction, and impacts confidentiality primarily, with limited effects on integrity and availability.

Root Cause

The root cause is missing path canonicalization and allow-list validation on the feature file name parameter. The handler trusts caller-supplied input and concatenates it into a filesystem path without rejecting traversal sequences or constraining the resolved path to the intended feature directory.

Attack Vector

An attacker issues a request that triggers the feature::LOADFEATUREFILE adminbin call and supplies a crafted feature file name containing relative path components. The adminbin resolves the traversal and returns the contents of the target file. See the cPanel Security Update Advisory for vendor technical details.

Detection Methods for CVE-2026-29201

Indicators of Compromise

Adminbin or cpsrvd log entries referencing LOADFEATUREFILE with feature names containing ../, encoded traversal sequences, or absolute paths.
Unexpected reads of sensitive files such as /etc/shadow, /etc/passwd, or cPanel configuration files correlated with WHM adminbin activity.
Requests to WHM endpoints invoking feature::LOADFEATUREFILE from unauthenticated or unexpected source addresses.

Detection Strategies

Inspect cPanel adminbin logs for feature::LOADFEATUREFILE calls whose file name argument contains .., /, null bytes, or URL-encoded variants.
Alert on adminbin invocations that resolve outside the expected feature file directory tree.
Correlate WHM request logs with filesystem audit logs (auditd) to surface reads of sensitive paths originating from cPanel daemons.

Monitoring Recommendations

Enable verbose logging for cPanel adminbin handlers and forward logs to a centralized SIEM for retention and search.
Monitor outbound responses from WHM for unusually large or sensitive file content payloads.
Track per-source request rates against WHM administrative endpoints to identify scanning or enumeration behavior.

How to Mitigate CVE-2026-29201

Immediate Actions Required

Apply the cPanel WHM WP2 security update released on May 08, 2026, on all affected servers.
Restrict network access to WHM administrative ports (typically TCP 2086/2087) to trusted management networks only.
Review adminbin and WHM logs for evidence of prior exploitation attempts targeting LOADFEATUREFILE.

Patch Information

cPanel released a fix in the WP2 update train on May 08, 2026. Full details are available in the cPanel Security Update Advisory. Administrators should run the standard cPanel update procedure to install the patched release on every affected host.

Workarounds

Block external access to WHM ports at the network perimeter until patching completes.
Use host-based firewalls or cphulkd rules to limit adminbin-reachable interfaces to trusted addresses.
Rotate credentials, API tokens, and keys stored on the server if logs indicate the feature::LOADFEATUREFILE handler was abused.

bash

# Configuration example: update cPanel and restrict WHM access
/usr/local/cpanel/scripts/upcp --force

# Restrict WHM ports to a trusted management subnet (example with firewalld)
firewall-cmd --permanent --remove-port=2087/tcp
firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/24
firewall-cmd --permanent --zone=trusted --add-port=2087/tcp
firewall-cmd --reload