Detections
Analytics

CVE-2026-54420

high

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

References

https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html

https://securityaffairs.com/199127/security/shared-hosting-at-risk-litespeed-enterprise-bug-can-grant-root-from-a-single-tenant.html

https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html

https://www.securityweek.com/joomla-litespeed-vulnerabilities-exploited-in-attacks/

https://www.bleepingcomputer.com/news/security/cisa-warns-of-another-actively-exploited-cpanel-plugin-flaw/

https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html

https://securityaffairs.com/193684/security/u-s-cisa-adds-cisco-catalyst-and-litespeed-cpanel-plugin-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://github.com/Byungju/cve-research-lab

https://github.com/fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit

https://github.com/HORKimhab/CVE-2026-54420

https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420

https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/

Details

Source: Mitre, NVD

Published: 2026-06-14

Updated: 2026-07-23

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.5

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00063