HTTP Smuggling in cPanel allows potential leak of credentials.

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

======================================================================== CVE-2025-40929                                       CPAN Security Group ========================================================================

CVE ID:  CVE-2025-40929   Distribution:  Cpanel-JSON-XS       Versions:  before 4.40

MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS       VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Description ----------- Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Problem types ------------- - CWE-122 Heap-based Buffer Overflow

Solutions --------- Update to 4.40 or later, or apply the provided patch

References ---------- https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713 https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch

Credits ------- Michael Hudak of rasotec, reporter

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

We at cPanel have investigated these claimed vulnerabilities, both internally and via third-party subject-matter experts. We are unable to reproduce the claims using the information provided by the reporter. We do not consider these vulnerabilities to be valid, and we’re in the process of disputing them.

Jeremy Reeder | Application Security Engineer

On 4/21/25, 10:08, "Alan Coopersmith" <alan.coopersmith () oracle com> wrote: 3 new CVE's have been published for GNU Mailman 2.1.39, as bundled with cPanel and WHM, credited to Firudin Davudzada and Musazada Aydan.

Note that upstream declared GNU Mailman 2.1 (which requires Python 2), to be end of life back in 2020, and recommends migrations to Mailman 3 (which uses Python 3 instead): mailman-announce () python org<https://mail.python.org/archives/list/%3ca%20href=>/thread/TJLEX52N2ARNOQBC2ZNYMNV5U226R5NM/">https://mail.python.org/archives/list/mailman-announce () python org<mailto:mailman-announce () python org>/thread/TJLEX52N2ARNOQBC2ZNYMNV5U226R5NM/

CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 (cPanel/WHM Bundle) Details/POC: https://github.com/0NYX-MY7H/CVE-2025-43919

GNU Mailman 2.1.39, as bundled with cPanel and WHM, contains a critical directory traversal vulnerability in the /mailman/private/mailman endpoint. Unauthenticated attackers can exploit this flaw to read arbitrary files on the server, such as /etc/passwd or Mailman configuration files, due to insufficient input validation in the private.py CGI script.

CVE-2025-43920: Command Injection via Email Subject in GNU Mailman 2.1.39 (cPanel/WHM Bundle) Details/POC: https://github.com/0NYX-MY7H/CVE-2025-43920

GNU Mailman 2.1.39, as bundled with cPanel and WHM, is vulnerable to a critical command injection flaw that allows unauthenticated attackers to execute arbitrary operating system commands. The vulnerability occurs when an external archiver is configured using PUBLICEXTERNALARCHIVER or PRIVATEEXTERNALARCHIVER in the mmcfg.py configuration file, and the email subject line contains shell metacharacters that are not properly sanitized.

CVE-2025-43921: Unauthenticated Mailing List Creation in GNU Mailman 2.1.39 (cPanel/WHM Bundle) Details/POC: https://github.com/0NYX-MY7H/CVE-2025-43921

GNU Mailman 2.1.39, as bundled with cPanel and WHM, is vulnerable to an authentication bypass flaw that allows unauthenticated attackers to create mailing lists via the /mailman/create endpoint. The issue stems from missing access controls in the create CGI script, enabling attackers to abuse the mailing system for spam, phishing, or resource exhaustion.

-- -Alan Coopersmith- alan.coopersmith () oracle com<mailto:alan.coopersmith () oracle com> Oracle Solaris Engineering - https://blogs.oracle.com/solaris

On Mon, 2025-04-21 at 20:45 +0300, Valtteri Vuorikoski wrote: So at the moment it seems to me that the correct interpretation is c). Hard to tell because the modified source doesn't seem to be available in despite Mailman being GPL. Maybe someone needs to ask cPanel LLC to mail them a CD? cPanel's fork of mailman2-python3 is located here: https://github.com/cpanel/mailman2-python3

-Jim P.

On 2025-04-21 12:48, Valtteri Vuorikoski wrote: Are these vulnerabilities due to modifications made by the vendor (cPanel LLC) to their distributed version?

-Valtteri Direct quoting the CVE: Affected Software: GNU Mailman 2.1.39 (bundled with cPanel/WHM)

Especially if you can't reproduce it in pure MM 2.1.39.

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

In cPanel before 98.0.1, /scripts/cpanconfig performs unsafe operations on files (SEC-589).

In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).

In cPanel before 96.0.13, fixcpanelperl lacks verification of the integrity of downloads (SEC-587).

In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).

In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).