cPanel prior to 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
cpanel cpanel