cPanel prior to 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
cpanel cpanel