cPanel prior to 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
cpanel cpanel