cPanel prior to 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
cpanel cpanel