Unrated severityNVD Advisory· Published May 28, 2008· Updated Apr 23, 2026

CVE-2008-2478

Description

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel.

Affected products

CPanel/Cpanel2 versions
cpe:2.3:a:cpanel:cpanel:*:current:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cpanel:cpanel:*:current:*:*:*:*:*:*range: <=11.23.1
- cpe:2.3:a:cpanel:cpanel:*:stable:*:*:*:*:*:*range: <=11.8.6

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.securityfocus.com/bid/29277nvdExploit
www.securityfocus.com/archive/1/492223/100/0/threadednvd
www.securityfocus.com/archive/1/492259/100/0/threadednvd
www.securitytracker.com/idnvd
exchange.xforce.ibmcloud.com/vulnerabilities/42529nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000