cPanel prior to 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
cpanel cpanel