Cyber Resilience

CVE-2026-29201

High

Published: 08 May 2026

Published
08 May 2026
Modified
13 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score 0.0043 34.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-29201 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Cpanel (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 34.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

CWE(s)
CWE-23

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Arbitrary file read via relative path traversal directly enables reading data from the local system.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Cpanel
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References