CVE-2025-66429: An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file…

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.71%

48.8th percentile

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cpanel	cpanel	>= 110.0.0 < 126.0.37	126.0.37
cpanel	cpanel	>= 128.0.1 < 130.0.16	130.0.16
cpanel	cpanel	>= 132.0.0 < 132.0.4	132.0.4

Detection & IOCsextracted from sources · hover to see the quote

→Target the Team Manager API endpoint in cPanel for directory traversal patterns (e.g., path sequences such as '../' in API parameters that could lead to arbitrary file overwrites) ↗
→Monitor for privilege escalation to root following suspicious file write operations originating from cPanel Team Manager API calls ↗
→Affected cPanel versions are 110 through 132; flag any unpatched instances in this range as high-priority targets (fix available as of Dec 16, 2025) ↗

·No public exploit is confirmed at this time, but EPSS exploitation probability is noted at 37.8 percentile, suggesting moderate exploitation likelihood ↗
·A fix was made available on December 16, 2025; ensure cPanel instances are patched beyond version 132 or to the vendor-supplied fix ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.