{"id":"CVE-2025-66429","title":"An issue was discovered in cPanel 110 through 132","summary":"An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"cpanel","product":"cpanel","affected":["cpanel >= 110.0.0, < 126.0.37","cpanel >= 128.0.1, < 130.0.16","cpanel >= 132.0.0, < 132.0.4"],"patched":["cpanel 132.0.4"],"published":"2025-12-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T20:10:00.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66429","references":[{"url":"https://docs.cpanel.net/changelogs/126-change-log/","label":"cve@mitre.org"},{"url":"https://docs.cpanel.net/release-notes/release-notes/","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00825,"epssPercentile":0.56458,"ingestedAt":"2026-10-14T20:53:12.285Z","slug":"CVE-2025-66429","body":"## Overview\n\nAn issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.\n\n## Affected\n\n- `cpanel >= 110.0.0, < 126.0.37`\n- `cpanel >= 128.0.1, < 130.0.16`\n- `cpanel >= 132.0.0, < 132.0.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cpanel 132.0.4`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}