Backup Trust, Broken: A cPanel Plugin Bug Turns Permission Hygiene Into a Security Event
A high-severity flaw in a Linux backup plugin shows how quickly a hosting control-plane weakness can become a privilege-escalation problem.
Introduction
Backups are supposed to be the safety net. In a hosting stack, though, the backup layer often sits close to the keys of the kingdom: files, accounts, recovery points, and the routines that can overwrite them. That is why a permission mistake in a cPanel and WHM backup plugin matters well beyond its CVSS score. It is not just a bug in an add-on. It is a weakness in a trusted control path.
Fast Facts
- CVE-2026-87886 is rated 7.8 and described as a high-severity issue.
- The flaw affects the Acronis Backup plugin for cPanel and WHM on Linux deployments.
- The root cause is insecure file permissions, which can open the door to local privilege escalation.
- The vulnerability has been exploited in the wild in targeted attacks.
- Exact affected build numbers were not visible in the provided material, so version checks should stay vendor-specific.
Body
What makes this case technically important is the attack class, not just the product name. Local privilege escalation usually means the intruder already has some foothold on the machine, even if only as a low-privileged user or through another weak service. The bug then becomes a stepping stone: if critical plugin files or directories are writable when they should not be, trusted components can be tampered with and the attacker can move upward in privilege.
That maps cleanly to the long-standing risk behind unsafe permissions on critical resources. In hosting environments, the control plane is especially sensitive because plugins are not decorative extras. They extend administrative functions, register with the interface, and in this case support browsing and recovery of backup content. When a backup tool is part of the path that can restore or overwrite live data, any trust failure in its files or directories deserves immediate attention.
For defenders, the first practical step is version inventory across every affected host, followed by a permission audit of the plugin footprint. Anything writable by non-root users should be treated as a finding. Teams should also watch for unexpected chmod, chown, file replacement, or unusual executables in plugin paths. The available information supports a risk analysis, not a definitive claim about downstream compromise, persistence, or data theft.
There is a broader operational lesson here. Security teams often focus on the visibility of a service, but not every high-value weakness announces itself with remote code execution. Sometimes the more dangerous flaw is mundane: a permissions mistake in a trusted component that sits close to recovery, administration, and filesystem control. In multi-tenant hosting, that kind of weakness can turn one local foothold into a much larger incident.
Conclusion
The real warning is not that backups are unsafe by design. It is that backup tooling inherits the trust of the platform it serves, so its file permissions, ownership, and operational boundaries have to be treated like core infrastructure. When those controls slip, attackers do not need much imagination - they only need a foothold and a path upward.
TECHCROOK
External backup drive For teams that depend on hosted systems, an external backup drive or similar offline storage can keep a separate copy of critical files and configuration snapshots. Regularly tested backups make recovery more practical when a server-side component or plugin is compromised or misconfigured.
WIKICROOK
- Privilege escalation: A technique where an attacker moves from limited access to higher system privileges, such as administrative control.
- Insecure file permissions: A weakness where files or directories are writable or readable by users who should not have that access.
- Local attack: An attack that requires some existing access on the target machine, rather than direct remote entry.
- WHM: Web Host Manager, the administrative control panel used to manage cPanel-based hosting environments.
- CWE-732: A weakness category for incorrect permission assignment on critical resources.
