cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
Published August 2, 2019.
Cpanel Cpanel