CVE-2026-54420

The LiteSpeed cPanel plugin, as distributed through the LiteSpeed WHM plugin, before version 2.4.8 (WHM plugin 5.3.2.0) mishandles UNIX symbolic links supplied by users (CWE-61). An attacker who already has FTP or web shell access to any account on a shared hosting server running CloudLinux/CageFS can plant a crafted symlink that the privileged plugin follows, letting them act beyond their own account scope — reportedly gaining root control of the entire server (CVSS scope change, C:H/I:H/A:H). Any hosting provider running vulnerable versions of the LiteSpeed cPanel/WHM plugin is affected, and because this is shared hosting, a single malicious tenant endangers other customers on the same server. The flaw was exploited in the wild in May 2026, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-15 (BOD 26-04 remediation obligations apply), and has a 1.4% 30-day EPSS; no public proof-of-concept is known.

What to do: Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later via the LiteSpeed WHM plugin 5.3.2.0 or later, following vendor instructions to meet CISA KEV/BOD 26-04 timelines. Until patched, restrict or monitor FTP and web shell access on affected shared hosting servers and review logs for signs of privilege escalation during and since May 2026; if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use.