cPanel has released security updates addressing an issue where File Manager could access symbolic links (symlinks) that are not accessible via SSH, potentially allowing users to access files they would not normally be able to view, depending on file permissions.

Affected Versions

This issue has been resolved in the following cPanel & WHM releases:

  • Version 110: 11.110.0.134 or later
  • Version 126: 11.126.0.77 or later
  • Version 134: 11.134.0.44 or later
  • Version 136: 11.136.0.28 or later

If your server is running an earlier build within any of these release branches, you should update as soon as possible using the latest available security release.

Apply the Security Update

Before running the update, replace 11.136.0.28 with the patched version that matches your cPanel release tier:

  • Version 110: 11.110.0.134

  • Version 126: 11.126.0.77

  • Version 134: 11.134.0.44

  • Version 136: 11.136.0.28

Then run:

chattr -ia /etc/cpupdate.conf /usr/local/cpanel/version
rm -f /usr/local/cpanel/logs/license_log; touch /usr/local/cpanel/cpanel.lisc
VERSION=11.136.0.28; sed -i "s/^CPANEL=.*/CPANEL=$VERSION/g" /etc/cpupdate.conf
echo "$VERSION" > /usr/local/cpanel/version
/scripts/upcp --force

Important: The example above uses 11.136.0.28. If your server is on another cPanel release tier, replace 11.136.0.28 with the appropriate patched version before executing the commands.

After the update completes, verify the installed version:

/usr/local/cpanel/cpanel -V

Ensure the reported version is at or above the patched release for your cPanel tier.

Temporary Mitigation

If you are unable to update immediately, cPanel recommends disabling File Manager for cPanel users until the server can be upgraded.

Disable via WHM

Navigate to:

WHM → Packages → Feature Manager → Feature Lists

Edit the desired feature list (for example, disabled), uncheck File Manager, and save the changes.

Disable via Command Line

whmapi1 update_featurelist featurelist=disabled filemanager=0

This prevents cPanel users from accessing File Manager until the security update can be installed.

Impact

This issue could allow users to follow symlinks and access information that would normally be inaccessible through SSH, including files within other users' home directories if underlying file permissions permit access.

We strongly recommend updating all affected cPanel & WHM servers as soon as possible to ensure your systems remain protected.



Thursday, July 9, 2026

« Back