cPanel prior to 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
cpanel cpanel