High severity8.8NVD Advisory· Published May 8, 2026· Updated May 15, 2026
CVE-2026-29203
CVE-2026-29203
Description
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
2- ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and MoreThe Hacker News · May 11, 2026
- cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch NowThe Hacker News · May 9, 2026