CVE-2026-105476

Summary

The flaw allows authenticated low-privilege users to exploit improper link resolution in cPanel to write arbitrary files owned by root, enabling privilege escalation to full system control.

Exploitability

Requires valid authentication as a low-privilege user; no elevated privileges or external dependencies needed beyond access to the vulnerable cPanel interface.

Blast radius

Successful exploitation grants attackers root-level file write capabilities, enabling complete system compromise including persistence, credential theft, and lateral movement.

Detection

Monitor for unexpected creation of root-owned files in world-writable directories or non-standard paths via cPanel file operations; look for log entries showing file writes initiated by low-privilege users to sensitive system locations.

Prioritized remediation

Upgrade to cPanel version 2.590 or later, as this is the first version that includes the fix for improper link resolution before file access (CWE-59).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.