cPanel prior to 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
cpanel cpanel