CVE-2026-29205

This repository contains a functional exploit for CVE-2026-29205, a CalDAV path-traversal vulnerability in cPanel/WHM, allowing arbitrary file reads as root. It includes a scanner for CVE-2026-41940 (authentication bypass) and an exploit chain for CVE-2026-29205, leveraging SMTP sub-addressing to create malicious maildir folders and exfiltrate files via CalDAV.

This repository contains a functional exploit scanner for CVE-2026-29205, a pre-authentication arbitrary file read vulnerability in cPanel/WHM's CalDAV daemon (cpdavd). The exploit leverages SMTP plus addressing to create a malicious maildir folder and then uses CalDAV path traversal to read files as root.

This repository contains a functional exploit scanner for CVE-2026-29205, a pre-authentication arbitrary file read vulnerability in cPanel/WHM's CalDAV daemon (cpdavd). The exploit leverages SMTP plus addressing to create a malicious maildir folder and then uses CalDAV path traversal to read files as root.

This repository contains a functional exploit for CVE-2026-29205, a pre-authentication path traversal vulnerability in cPanel/WHM's CalDAV daemon (cpdavd). The exploit leverages SMTP plus alias to create a directory structure that enables arbitrary file reads as root due to a permission downgrade object lifecycle error.