CVE-2003-1426: cPanel

Low severity, CVSS 3.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.

Affected products

• cPanel cPanel: version 5.0 only

Published 2003-12-31. Last modified 2026-06-16.