cPanel prior to 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).
cpanel cpanel