CVE-2025-66429: cPanel

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

Affected products

• cPanel cPanel: from 110.0.0, before 126.0.37 (fixed in 126.0.37); from 128.0.1, before 130.0.16 (fixed in 130.0.16); from 132.0.0, before 132.0.4 (fixed in 132.0.4)

Published 2025-12-11. Last modified 2026-06-17.