cPanel prior to 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
cpanel cpanel