CVE-2026-54420: high-severity vulnerability in LiteSpeed Technologies cPanel Plugin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
The LiteSpeed cPanel plugin before version 2.4.8 fails to properly handle symbolic links (symlinks), allowing users with FTP or web shell access on shared hosting servers to access files they shouldn't be able to reach. This is a serious risk on multi-user hosting environments running CloudLinux/CageFS.
CWE-61 (Improper Handling of Symbolic Links) in LiteSpeed cPanel plugin <2.4.8 permits privilege escalation or unauthorized file access through symlink manipulation by authenticated users (FTP/web shell) on shared hosting with CloudLinux/CageFS. Pre-condition: attacker must have FTP or web shell credentials on the hosted server. Impact includes potential information disclosure or lateral movement between isolated user environments.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.