cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Link | Tags |
---|---|
https://documentation.cpanel.net/display/CL/58+Change+Log | release notes vendor advisory |