An error in privilege handling and inadequate path validation allows an attacker to read any file on the server when requesting attachments through the cpdavd download endpoints. The flaw can expose sensitive configuration files, credentials, or application data, thereby compromising confidentiality and potentially enabling further exploitation. The weakness is identified as a privilege escalation flaw (CWE‑250).

The vulnerability affects WebPros’ WP Squared and cPanel products. Versions are not explicitly enumerated in the advisory, so any installation of these products is potentially impacted until a patch is applied.

The CVSS score of 8.6 indicates a high severity level. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, meaning an exploit is not yet confirmed in the wild. The likely attack vector is a web‑based request to the cpdavd endpoint, possibly requiring valid authentication but not guaranteed to be unauthenticated. Because the flaw permits arbitrary file reads, an attacker could exfiltrate data or pivot to further attacks if other vulnerabilities exist.