According to the cPanel changelog (changelog.cpanel.net) as well as discussions on other forums there is a rather serious arbitrary file inclusion vulnerability in Horde (all current versions).

This had been taken care of as soon as cpanel released the patch. Sorry for the delay in updating you.

You can see the original thread here