Overview
cPanel has released an official security patch addressing CVE-2026-29203, a vulnerability caused by unsafe symlink handling. This flaw could allow an authenticated user to perform `chmod` operations on arbitrary files, potentially leading to a denial of service (DoS) or privilege escalation.
Official details: cPanel Security Advisory – CVE-2026-29203]
Patched Versions
The following cPanel releases include the fix:
- 11.136.0.9
- 11.134.0.25
- 11.132.0.31
- 11.130.0.22
- 11.126.0.58
- 11.124.0.37
- 11.118.0.66
- 11.110.0.117
- 11.102.0.41
- 11.94.0.30
- 11.86.0.43
Update Procedure
Use the following commands to force an update to a specific patched version (example uses `11.136.0.9`):
chattr -ia /etc/cpupdate.conf /usr/local/cpanel/version
rm -f /usr/local/cpanel/logs/license_log
touch /usr/local/cpanel/cpanel.lisc
VERSION=11.136.0.9
sed -i "s/^CPANEL=.*/CPANEL=$VERSION/g" /etc/cpupdate.conf
echo "$VERSION" > /usr/local/cpanel/version
/scripts/upcp --force
Important Notes for CentOS 6 & 7 Users (including CloudLinux)
Replace `VERSION` with a target release that is compatible with your operating system.
Do not attempt to update to a higher tier (e.g., CURRENT or EDGE) unless explicitly supported by your OS.
Verify OS compatibility before proceeding.
Recommendation
Apply the patch immediately to all affected systems to mitigate the risk of privilege escalation and denial of service.
Saturday, May 9, 2026
