---
id: CVE-2025-66429
title: An issue was discovered in cPanel 110 through 132
summary: >-
  An issue was discovered in cPanel 110 through 132. A directory traversal
  vulnerability within the Team Manager API allows for overwrite of an arbitrary
  file. This can allow for privilege escalation to the root user.
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: cpanel
product: cpanel
affected:
  - 'cpanel >= 110.0.0, < 126.0.37'
  - 'cpanel >= 128.0.1, < 130.0.16'
  - 'cpanel >= 132.0.0, < 132.0.4'
patched:
  - cpanel 132.0.4
published: '2025-12-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66429'
references:
  - url: 'https://docs.cpanel.net/changelogs/126-change-log/'
    label: cve@mitre.org
  - url: 'https://docs.cpanel.net/release-notes/release-notes/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00825
epssPercentile: 0.56458
ingestedAt: '2026-10-14T20:53:12.285Z'
---

## Overview

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

## Affected

- `cpanel >= 110.0.0, < 126.0.37`
- `cpanel >= 128.0.1, < 130.0.16`
- `cpanel >= 132.0.0, < 132.0.4`

## Remediation

Upgrade past the affected range:

- `cpanel 132.0.4`