Security advisory · VP-2026-005
Backup restores and cPanel imports could reach other accounts' data
Restoring a backup, or importing a cPanel backup in vWHM, could affect databases and database users outside the account being restored. Vanta Panel 5.50 limits restores and imports to the account's own databases and database users.
- Severity
- High
- Affected
- Vanta Panel 5.49 and earlier
- Fixed in
- Vanta Panel 5.50
- Component
- Backup restore and cPanel import
- Published
Who is affected?
Servers where customers restore their own backups, and servers that imported cPanel backups from sources that are not fully trusted. A hosting customer could reach other customers' databases this way.
Affected: Vanta Panel 5.49 and earlier. Fixed in Vanta Panel 5.50.
What should I do?
Update to Vanta Panel 5.50 or later. If cPanel backups from sources you do not fully trust were imported before 5.50, review the server's database users and their access.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
The fix applies to every restore and import after the update. Changes made by an earlier restore or import are not undone automatically.
Credit
Found in Vanta Panel's own security review.
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-005
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-005?
Vanta Panel 5.49 and earlier that have not installed the fix. It is fixed in Vanta Panel 5.50.
What should I do about VP-2026-005?
Update to Vanta Panel 5.50 or later. If cPanel backups from sources you do not fully trust were imported before 5.50, review the server's database users and their access.
Is the fix for VP-2026-005 installed automatically?
The fix applies to every restore and import after the update. Changes made by an earlier restore or import are not undone automatically.
Other advisories
VP-2026-007Criticalfixed in 5.54
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
VP-2026-006Mediumfixed in 5.52
Some removed database hosts and subdomains stayed active
VP-2026-004Highfixed in 5.50
Database permissions could reach another account's databases
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash