What’s Vulnerable › Vulnerabilities

CVE-2020-12785

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-11 · updated 2026-06-17

Description

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).

Affected products

• WebPros cPanel: from 11.78.0.1 before 11.78.0.47; from 11.84.0.0 before 11.84.0.22; from 11.86.0.1 before 11.86.0.14 — fixed in 11.78.0.47, 11.84.0.22, 11.86.0.14

How to fix

Upgrade to a fixed version: WebPros cPanel 11.78.0.47, 11.84.0.22, 11.86.0.14. Check the vendor advisory for mitigations.

References

• https://documentation.cpanel.net/display/CL/86+Change+Log
• https://news.cpanel.com/cpanel-tsr-2020-0002-full-disclosure/
• https://documentation.cpanel.net/display/CL/86+Change+Log

Get alerted when CVE-2020-12785 or the next vulnerability affects your stack