The vulnerability is due to insufficient validation of the file name supplied to the feature::LOADFEATUREFILE administration API call. By submitting a relative file path, an attacker can read any file that the cPanel process can access. This can expose sensitive configuration files, credentials, or system logs, and constitutes an input validation flaw (CWE‑20).

The issue affects WebPros products, specifically cPanel, including the WP Squared and WP2 dashboards, as well as cPanel running on CentOS 6 and CloudLinux 6. No specific version numbers are listed in the advisory, so any installation of these products remains a potential risk until a patch is applied.

The CVSS score is 4.3, and no EPSS data is available; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must possess administrative credentials to call the feature::LOADFEATUREFILE endpoint, implying an authenticated admin API as the attack vector. Because the endpoint is privileged, the practical likelihood of exploitation is moderate for sites with exposed or misconfigured admin APIs. The primary impact is disclosure of arbitrary files, which could enable further compromise or data exfiltration.