CPANEL-53195: External requests trigger HTTP 500 via cPanel 404 safelock failure

Zoltan Egri | 1b.hu

• September 01, 2026 12:07

We recently investigated CPANEL-53195 on a production server running cPanel 136.0.38 and found some additional behavior that may be useful to others.

Distributed external scanners were repeatedly requesting:

/unprotected/json-minified.js.map

The file does not exist, and each request entered the cPanel 404 handling path, resulting in:

webmaild.lock / cpaneld.lock – Permission denied

followed by an HTTP 500 response.

cPanel Technical Support escalated our case and reproduced the HTTP 500 behavior themselves. They confirmed that it is related to CPANEL-53195 and added the HTTP 500 behavior to the developer case.

In our environment this also caused production monitoring alerts:

cPanel web storage/session/backend errors is CRITICAL

As a temporary mitigation, we added a ModSecurity rule that intercepts this specific URI before it reaches cpsrvd. The request then returns HTTP 404 instead of HTTP 500, and the safelock error is no longer triggered.

cPanel Support explained that the underlying issue originates from a previous security-related change and that a permanent resolution requires changes to the lock-file generation code.

I am posting this separately because the externally-triggerable HTTP 500 behavior and temporary mitigation may help other administrators encountering CPANEL-53195.

Zoltan Egri
1b.hu

• 

  cPRex Jurassic Moderator

  • September 01, 2026 13:35

  Thanks for sharing this!

  0
• 

  Zoltan Egri | 1b.hu

  • September 01, 2026 20:38

  Thanks!

  Quick update: still reproducible on 136.0 build 38 — we upgraded from build 37 specifically to check, and the same webmaild.lock Permission denied error came back shortly after, followed by the 500.

  Worth noting the trigger is an unauthenticated external request for a missing static file, coming from distributed scanners. Any internet-facing cPanel server will see this traffic.

  Is there a target version for the fix, or is CPANEL-53195 still under investigation? And is a request-level block (we used a targeted ModSecurity rule) the recommended interim mitigation?

  Full write-up with logs and the workaround: https://1b.hu/blog/cpanel-hiba-okozta-a-rejtelyes-500-as-szerverhibakat

  0
• 

  cPRex Jurassic Moderator

  • September 01, 2026 22:47

  Yes - the request-level block is still the best plan at this time.

  No - I don't have a specific build targeted for this fix just yet.  I did add your blog notes to the case for the developers to review.

  Once I hear something on my end I'll be sure to post!

  0

Please sign in to leave a comment.