Skip to main content
Back to Research blog

Advisory: Reflected Cross-Site Scripting in cPanel (CVE-2023-29489)

Get research alerts

Share on social

April 26, 2023

Lorem ipsum

Table of Contents

TOC Element

Impact

It is possible to execute arbitrary JavaScript, pre-authentication in the context of a victim, on almost every port of a webserver using cPanel within its default setup.

Even on port 80 and 443, it is possible to reach the /cpanelwebcall/ directory as it is being proxied to the cPanel management ports by Apache.

Because of this, an attacker can not only attack the management ports of cPanel but also the applications that are running on port 80 and 443.

Due to the fact that the cPanel management ports are vulnerable to this cross-site scripting attack, an attacker could leverage this vulnerability to hijack a legitimate user’s cPanel session.

Once acting on behalf of an authenticated user of cPanel, it is usually trivial to upload a web shell and gain command execution.

Affected Software

The following versions are affected by this cross-site scripting vulnerability:

  • < 11.109.9999.116
  • < 11.108.0.13
  • < 11.106.0.18
  • < 11.102.0.31

Product Description

cPanel is a web hosting control panel software that is deployed widely across the internet.

Solution

This vulnerability can be remediated by upgrading to any of the following cPanel versions or above:

  • 11.109.9999.116
  • 11.108.0.13
  • 11.106.0.18
  • 11.102.0.31

cPanel’s official advisory can be found here.

Blog Post

The blog post detailing the steps taken for the discovery of this vulnerability can be found here.

Credits

Shubham Shah - Assetnote Security Research Team

Timeline

The timeline for this disclosure process can be found below:

  • Jan 23rd, 2023: Disclosure of the XSS vulnerability to cPanel via security@cpanel.net.
  • Jan 23rd, 2023: Confirmation from cPanel that they have received the vulnerability and are investigating further.
  • Feb 12th, 2023: Request for updates from Assetnote side
  • Feb 13th, 2023: Vulnerability confirmed by cPanel and assigned SEC-669. Targeted security fix release to follow in a few weeks.
  • March 1st, 2023: Vulnerability fixed and public disclosure released on cPanel website.
Shubham Shah

Author

Shubham Shah

Chief Security Research Officer at Searchlight Cyber

Connect

Shubham Shah is Chief Security Research Officer, having joined Searchlight Cyber following the acquisition of Assetnote, where he was Co-Founder and CTO. Shubham leads the global security research team whose findings feed directly into Searchlight Exposure – surfacing zero-day vulnerabilities in the tools organisations rely on, often months ahead of public disclosure. He remains a prolific bug bounty hunter ranked in the top 50 hackers on HackerOne, and has presented at various industry events including QCon London, Kiwicon, AusCert, BSides Canberra, and CrikeyCon.

Explore related Content

Research

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

July 20, 2026

Research

wp2shell: Pre Authentication RCE in WordPress Core

July 17, 2026

Research

Smashing the ServiceNow Sandbox – Pre Authentication RCE

July 14, 2026

Research

CargoWise WebTracker – The Keys Were in the Cargo

June 25, 2026

Research

Two Bypasses for Chrome's Sanitizer API

May 22, 2026

Research

Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082)

May 21, 2026

View all