Servers and applications
CVE-2004-1603
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
- Severity
- Medium 5.5
- Published
- 18 Oct 2004
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1.6% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Link following (CWE-59)
- Attack
- Needs local access · Needs a user account · No user action needed
- Attacker can
- Read data
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
cPanel & WHMServers and applications · cpe:a:cpanel:cpanel |
|