cPanel prior to 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
cpanel cpanel