CVE-2026-105476: cPanel Reseller Root File Write - Floor 138.0.19

CVE-2026-105476 is HackerOne’s name for improper link resolution before file access in cPanel & WHM. CNA title: Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges. CVE state PUBLISHED. datePublished 2026-11-02T21:05:16.335Z. Record last updated 2026-11-03T04:56:48.971Z. CWE is CWE-59. Finder: Boomerang (boomerang_). CNA: HackerOne. Product: WebPros cPanel.[1][2]

CISA’s ADP row (Secondary) scores it 8.8 High (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). NVD vulnStatus is Awaiting Analysis. CISA SSVC on that row: Exploitation none, Automatable no, Technical Impact total. It is not on CISA KEV. Catalog 2026.11.04, 1,768 entries.[2][3][4]

cPanel’s own advisory (created 19 October, edited 30 October, titled with 26 October 2026) is more specific than the CNA sentence: a user can direct a root-privileged process into writing a file to a location of the reseller’s choosing. Impact line: a reseller account can create or overwrite files anywhere on the server as root. Affected: cPanel & WHM v78 and later. Patched: 110.0.154 / 134.0.67 / 136.0.51 / 138.0.19 or later.[5]

Same TSR also ships CVE-2026-105475: unauthenticated read of any mail account’s calendar and contact data (CWE-158 NUL byte). That is a different bug. One upcp covers both on CURRENT / 136 / 134. LTS 110 is in the 105476 vendor table; it is not in the 105475 vendor table.[6][7]

If you run shared or reseller cPanel, this is the version floor.

What it is

This is a panel privilege bug, not a web-server RCE and not an unauthenticated internet shell.[1][5]

cPanel’s advisory, paraphrased only as far as the published sentences go: a reseller can make a root-privileged helper write a file where the reseller points. The CNA maps that to CWE-59 (link following) and to privilege escalation via arbitrary root-owned file write. We did not reverse the helper, the symlink, or the argument. Public facts stop at: authenticated, low privilege, reseller-chosen path, write as root.[1][5]

PR:L on the 8.8 vector means not “anyone on the internet.” On a shared box that still means every reseller - and anything that already has a reseller session: a compromised reseller WordPress, a leaked WHM reseller cookie, a former staff account you forgot to drop.[2]

The sibling CVE-2026-105475 is the opposite shape: no credentials. CNA: Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. cPanel: calendar entries and contacts of any mail account the server hosts. CNA CVSS 4.0 8.7 High (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial. Finder: rz1027.[6][7]

That is mail PII, not root. Do not flatten the two IDs into one story.

How serious is it?

105476 is tenant-to-root on the file write. CISA’s “technical impact: total” is that claim in SSVC form. A root-owned overwrite is a classic path to authorized_keys, cron, panel configs, or a rewritten helper. The vendor did not publish a worked exploit. CISA’s exploitation field is none. We have not seen this CVE on KEV.[2][3][4][5]

105475 is unauthenticated and automatable on CISA’s row. Calendar and CardDAV data is still credentials-adjacent (names, emails, meeting links, phone numbers). It is not a shell.[6][7]

CSIRT-ITA published a same-day pair alert on 3 November 2026 (AL05/261103) calling the pair privilege escalation / arbitrary file write / information disclosure. That is a national CSIRT restatement of the vendor bulletins, not a new technical finding.[8]

Who is affected

CVE-2026-105476 - vendor: cPanel & WHM v78 and later until you hit a patched build. CNA lessThan floors (same numbers, 11. prefix): 11.138.0.19, 11.136.0.51, 11.134.0.67, 11.110.0.154. defaultStatus is unaffected, so the listed build is the first fixed version on that train.[1][5]

CVE-2026-105475 - vendor: v124 and later, patched 134.0.67 / 136.0.51 / 138.0.19. The vendor table does not list 110. The CNA does list lessThan 11.110.0.154. Treat 110 as in-scope for 105476; do not assume 110 is in-scope for 105475 from the vendor article. Ask WebPros if you are on 110 and need a 105475 statement.[6][7]

CNA product is WebPros cPanel. These two records do not name WP Squared. Do not copy a WP Squared floor from an older TSR.

CURRENT 138 has already moved on: changelog 138.0.21 is dated 5 November 2026. The security floor for this pair remains 138.0.19, not “whatever 138 you happen to be on below 19.”[9]

What to do now

Read the build, not the major. As root: /usr/local/cpanel/cpanel -V. Compare to the floor for your train. 138.0.18 is still below 138.0.19. 110.0.153 is still below 110.0.154.
Patch. Vendor call to action is the stock updater.[5][10]

/usr/local/cpanel/scripts/upcp --force
/usr/local/cpanel/cpanel -V

WHM: Home → cPanel → Upgrade to Latest Version. Confirm the printed version is ≥ the floor, not merely that upcp exited 0.

Shared and reseller boxes first. 105476’s published actor is a reseller. Boxes with customer reseller accounts are the queue head. Single-owner VPS still patch; the bug class is still a root file write once a low-priv cPanel user exists.[5]
Do not wait for a documented workaround. Neither vendor article publishes one. CageFS / LVE / open_basedir are not listed as mitigations. Do not invent a “disable CalDAV” toggle as a 105476 fix - 105476 is the root write, 105475 is the calendar read.[5][6]
After the new build is running, look for the published impact classes - not a CVE-specific IoC (none was published). For 105476: unexpected root-owned files in paths a reseller should not write, new root cron, new keys under /root/.ssh/. For 105475: you generally cannot prove a calendar scrape from the advisory text. If the box was on an affected build while CalDAV/CardDAV was reachable from the internet, treat exported address books as possibly copied and rotate what those contacts unlock (app passwords, meeting links you treat as secret). That last sentence is operator hygiene, not a vendor finding.

Versions with no floor

Vendor 105476 starts at v78. If you are on a train WebPros no longer patches, there is no 110.0.154 / 134.0.67 / 136.0.51 / 138.0.19 for you. Move the server onto a supported major, or replace the panel. Staying on an abandoned train is not a mitigation.[5]

LTS 110: you stay on 110; you still need 110.0.154+ for 105476. Pinning CURRENT away does not skip the TSR on 110.

Compromise signs

None of these prove CVE-2026-105476 by themselves. Together they are enough to snapshot, rotate, and restore from known-good.

/usr/local/cpanel/cpanel -V below the floor and reseller accounts present.
Root-owned files whose mtime sits in the unpatched window, in places a reseller UI should not touch.
New authorized_keys, new root crontab lines, unexpected upcp / cpsrvd binaries versus a known-good package list.
For 105475: CalDAV/CardDAV reachable without auth from addresses you do not recognize. The advisory does not give a log signature; absence of a log line proves nothing.

FAQ

Is this on CISA KEV? No. Catalog 2026.11.04 (1,768 entries) does not list CVE-2026-105476 or CVE-2026-105475. The 3 Nov KEV add is WordPress core CVE-2026-119977.[4]

Is it being exploited? CISA ADP SSVC says Exploitation none on both IDs (as of the NVD pull this morning). That is not the same as “safe.” It is also not KEV.[2][3][7]

Unauthenticated root? No. 105476 is authenticated / low privilege (reseller in the vendor write-up). 105475 is unauthenticated and reads calendar/contacts, not a root shell.[5][6]

Does the 138.0.19 changelog name these CVEs? No. 138.0.19 (2026-10-26) is a [Security] Security hardening build (plus Roundcube 1.6.20, Unbound, libzip). The CVE mapping is the support.cpanel.net articles, which list those patched versions. Do not treat the Roundcube line as this bug.[9]

Does WordPress 7.1.4 or PHP2Shell fix this? No. Those are Core and the PHP engine. This is cPanel’s own helpers. upcp is the fix.[5]

110 LTS and 105475? Vendor 105475 table starts at v124 and does not list 110. CNA still encodes lessThan 11.110.0.154. Patch 110 to 110.0.154 for 105476; do not claim 105475 is fixed or unfixed on 110 from the vendor article alone.[5][6][7]

Honesty

We did not reverse the link-following path or produce a PoC.
CVSS 8.8 is CISA ADP Secondary, not an NVD Primary score. NVD is Awaiting Analysis.[2]
Vendor actor is reseller; CNA says remote authenticated users. We are not collapsing those into “any cPanel user” beyond what the CNA already said.
Changelog 138.0.19 does not cite 105476/105475 by ID. Version floors come from the vendor articles + CNA lessThan lists.
No public exploitation evidence in the sources below. CSIRT-ITA is a patch-now alert, not a wild-use report.[8]

Sources

CVE-2026-105476 JSON - HackerOne CNA, CWE-59, Boomerang, lessThan 11.138.0.19 / 11.136.0.51 / 11.134.0.67 / 11.110.0.154, published 2026-11-02T21:05:16.335Z
NVD CVE-2026-105476 - Awaiting Analysis; CISA ADP CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); SSVC exploitation none / automatable no / technical impact total; lastModified 2026-11-03T16:25:21.310
CVE-2026-105476 - same CNA text
CISA KEV JSON - catalogVersion 2026.11.04, count 1768; these two CVEs absent
cPanel: CVE-2026-105476 Arbitrary File Write as Root - reseller-chosen path, write as root; v78+; floors 110.0.154 / 134.0.67 / 136.0.51 / 138.0.19; updated 2026-10-30T15:02:44Z
cPanel: CVE-2026-105475 Unauthenticated Calendar and Contact Data - no credentials; v124+; floors 134.0.67 / 136.0.51 / 138.0.19 (no 110 row); updated 2026-10-30T15:01:27Z
CVE-2026-105475 JSON / NVD - CWE-158, rz1027, CVSS 4.0 8.7, SSVC automatable yes / impact partial; CNA still lists 11.110.0.154
CSIRT-ITA AL05/261103, 3 Nov 2026 - pair alert, not a wild-use claim
cPanel 138 Change Log - 138.0.19 dated 2026-10-26 [Security] Security hardening; 138.0.21 dated 2026-11-05
How to update cPanel/WHM