LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP
Affects LiteSpeed cPanel plugin versions before 2.4.8 on shared hosting servers running CloudLinux/CageFS. Fixed in cPanel plugin 2.4.8 and WHM plugin 5.3.2.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2.4.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The LiteSpeed cPanel plugin and the LiteSpeed WHM plugin that distributes it, used on cPanel shared hosting servers running CloudLinux/CageFS, mishandle symlinks created by users. This may let a user with FTP or web shell access reach files or resources outside their permitted area.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- WHM and cPanel PlugIn
From 2.3 · fixed in 2.4.8
References 2
litespeedtech.com
blog.litespeedtech.com
Questions about CVE-2026-54420
What does this mean?
The plugin mishandles symlinks that a user supplies over FTP. A user with FTP or web shell access can use this to escalate privileges to root.Source: blog.litespeedtech.com
Am I affected, and how do I check?
The advisory lists LiteSpeed cPanel user-end plugin versions before 2.4.8 as affected, on shared hosting servers running CloudLinux/CageFS. Check the installed cPanel plugin version against 2.4.8 to see where a server stands.Source: blog.litespeedtech.com
What should I do about it?
Upgrade the cPanel plugin to v2.4.8 and the WHM plugin to v5.3.2.1. If the update cannot be applied, the vendor's workaround is to uninstall the user-end plugin with /usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall.Source: blog.litespeedtech.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-06-15, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data