{"id":"CVE-2026-105476","published":"2026-11-02T21:17:22.707","lastModified":"2026-11-03T05:18:27.880","description":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated low-privilege users to exploit improper link resolution in cPanel to write arbitrary files owned by root, enabling privilege escalation to full system control.","exploitability":"Requires valid authentication as a low-privilege user; no elevated privileges or external dependencies needed beyond access to the vulnerable cPanel interface.","blast_radius":"Successful exploitation grants attackers root-level file write capabilities, enabling complete system compromise including persistence, credential theft, and lateral movement.","remediation":"Upgrade to cPanel version 2.590 or later, as this is the first version that includes the fix for improper link resolution before file access (CWE-59).","detection":"Monitor for unexpected creation of root-owned files in world-writable directories or non-standard paths via cPanel file operations; look for log entries showing file writes initiated by low-privilege users to sensitive system locations.","tags":["privilege-escalation","cpanel","file-write","cwe59","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:59:10.930Z"}}