cPanel prior to 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
cpanel cpanel