cPanel prior to 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
cpanel cpanel