cPanel prior to 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
cpanel cpanel