{"affected":[{"defaultStatus":"unaffected","product":"cPanel","source":"CNA: hackerone","vendor":"WebPros","versions":[{"lessThan":"11.138.0.19","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.136.0.51","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.134.0.67","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.110.0.154","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-105476","cwes":["CWE-59"],"description":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793654579543,"publishedAt":1793653516335,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026"}],"remediation":[],"revision":"5a22c46c71cf6dc83925816ab49e129e56c7f19626656d89c39eeb8e3f5836c6","sources":[{"modifiedAt":1793654579543,"name":"CNA: hackerone","retrievedAt":1793657307957,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105476"}],"ssvc":{"assessedAt":1793654568430,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-105476","updatedAt":1793657307957}