cPanel prior to 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
cpanel cpanel