cPanel Security Advisory – CPANEL-2004:01-01 – When trying to change a user password in cPanel 8.x.x, it is possible to execute commands as root. cPanel suggests that administrators disable this feature until a fixed version is released.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32847/CPANEL-2004%3A01-01.txt
Source: https://packetstormsecurity.com/files/32847/CPANEL-2004-01-01.txt.html