cPanel prior to 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
cpanel cpanel