Symlinks that are not accessible via SSH are accessible via File Manager.

Situation

When using File Manager while logged in as a cPanel user, you find that you are able to view Symlinks to files that would not be viewable normally via SSH based access. When attempting to view these same Symlinks via SSH it is unsuccessful. 

We have opened an internal case with our developers with case ID CPANEL-47220 to review this behavior further.

Note: This has been resolved with the following patched versions in the table below. Please see the latest changelogs for version information of each cPanel branch:
https://docs.cpanel.net/changelogs/

Affected Product Versions

Impact

This could allow users to follow symlinks and access information that they would not normally have access to. Including access to other user's home directories depending on file permissions.

Call to Action

1. Update to the latest versions for your server; this can be achieved using the update script. 

# /scripts/upcp --security

      2. Once completed, verify the cPanel version with the following to ensure the update was successful.

# /usr/local/cpanel/cpanel -V

Mitigation

If you are unable to update, the following steps need to be taken to mitigate the behavior: 

Disabling File Manager access for cPanel users would be required to prevent this behavior.