cPanel prior to 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).
cpanel cpanel