{"id":"CVE-2026-105476","kind":"vulnerability","aliases":["CVE-2026-105476"],"related":[],"title":"cPanel: link resolution flaw lets a logged-in user write root-owned files","description":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","summary":"cPanel has an improper link resolution flaw before file access that lets an authenticated remote user write arbitrary root-owned files. An attacker who gets an account can use this to escalate privileges on the server.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpanel","infrastructure","self-hosted","shared-hosting"],"not_affected_if":["no-cpanel","no-untrusted-accounts"],"how_to_check":"- Confirm whether the server runs cPanel and which version it is installed at, using the cPanel version shown in WHM\n- Check the cPanel version against the affected range in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-105476)","fix":null,"status":"open","published_at":"2026-11-02T21:17:22+00:00","first_seen_at":"2026-11-02T21:35:40+00:00","triaged_at":"2026-11-02T21:37:21+00:00","updated_at":"2026-11-02T21:37:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T21:37:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"cPanel: link resolution flaw lets a logged-in user write root-owned files","impact":"high","summary":"cPanel has an improper link resolution flaw before file access that lets an authenticated remote user write arbitrary root-owned files. An attacker who gets an account can use this to escalate privileges on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cpanel","self-hosted","shared-hosting"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker writes root-owned files and gains full server control","analyst_note":"Find the affected and fixed cPanel versions and the vendor advisory, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105476.","how_to_check":"- Confirm whether the server runs cPanel and which version it is installed at, using the cPanel version shown in WHM\n- Check the cPanel version against the affected range in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-105476)\n- unknown for the exact affected version range, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-cpanel","no-untrusted-accounts"],"who_is_affected":"Servers running cPanel where users hold authenticated accounts are the exposed systems. Servers without cPanel, or where only fully trusted administrators have logins, are less exposed. The sources do not give the affected versions or the specific configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4056,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105476':18A,21A '-2026':17A,20A 'access':39B,72C 'account':57B 'allow':75C 'arbitrari':47B,81C 'attack':53B 'authent':43B,77C 'cpanel':1A,22B,30B,74C 'cve':16A,19A 'escal':62B,87C 'file':15A,38B,51B,71C,85C 'flaw':4A,36B 'get':55B 'host':26B,29B 'improp':33B,67C 'infrastructur':23B 'let':5A,41B 'link':2A,34B,68C 'log':8A 'logged-in':7A 'own':14A,50B,84C 'privileg':63B,88C 'remot':44B,76C 'resolut':3A,35B,69C 'root':13A,49B,83C 'root-own':12A,48B,82C 'self':25B 'self-host':24B 'server':66B 'share':28B 'shared-host':27B 'use':59B 'user':10A,45B,78C 'write':11A,46B,80C","nicknames":[],"mitigations":[],"who_affected":"Servers running cPanel where users hold authenticated accounts are the exposed systems. Servers without cPanel, or where only fully trusted administrators have logins, are less exposed. The sources do not give the affected versions or the specific configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cpanel","infrastructure","selfhosted","sharedhosting","unknown"],"first_public_at":"2026-11-02T21:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105476","severity":null,"published_at":"2026-11-02T21:17:22+00:00","modified_at":"2026-11-02T21:17:22+00:00","first_seen_at":"2026-11-02T21:35:40+00:00","fetched_at":"2026-11-02T21:35:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}