cPanel – Getpkginfo (Root) Arbitrary File Access Vulnerability

cPanel has released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system.

WHMCS Complete Billing and Support

Product: cPanel
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version:,, &

Vulnerability Description:

It is possible for a reseller to exploit a vulnerability in getpkginfo to open any file on the server, regardless of ownership which could ultimately lead to a root compromise. There is also a directory traversal present.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.