Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant
Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.
cPanel warned that a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise (fixed in 6.3.7) lets a malicious low-privilege website user bypass account isolation controls including CloudLinux CageFS and gain root on shared-hosting servers, enabling cross-tenant compromise. No CVE, severity rating, or technical details have been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420, which were actively exploited and added to CISA's KEV catalog.
- No workaround; admins must force update via lsup.sh -f -v 6.3.7
- 6.3.7 not yet on stable auto-update channel as of September 15
- OpenLiteSpeed open-source variant has no matching update
- Two earlier LiteSpeed CVEs were actively exploited and KEV-listed
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-48172 | Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin CVE-2026-48172 is a critical privilege-escalation flaw (CWE-266, incorrect privilege assignment) in the LiteSpeed User-End cPanel plugin before 2.4.5, stemming from mishandling of the plugin's Redis enable/disable feature. It is exploitable over the network without authentication or user interaction (CVSS 4.0: AV:N/AC:L/PR:N/UI:N), and exploitation leaves traces of requests to the cPanel API's redisAble function in cPanel logs. An attacker who exploits it can elevate privileges to possibly root on the hosting server, meaning a single attacker could take control of every account and site hosted on that server. At risk are hosting providers and organizations running cPanel/WHM with the LiteSpeed cPanel plugin (and the related WHM plugin), a common premium web-server setup on multi-tenant shared-hosting platforms. The flaw was exploited in the wild in May 2026, was added to CISA's KEV catalog on 2026-05-26, and carries an EPSS of 18.9% (97th percentile); no public PoC is known. Do: Upgrade the LiteSpeed User-End cPanel plugin to at least version 2.4.7 (versions before 2.4.5 are affected; 2.4.7 is the recommended minimum). Hunt for exploitation by running grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash: no output means you were not hit, while hits should be validated (confirm the listed IPs are legitimate, block any that are not, and review system logs for actions taken by those IPs). Because this is a CISA KEV entry (added 2026-05-26), apply the vendor fix per BOD 22-01 timelines or discontinue use of the product if mitigations are unavailable. | 10.0 | 19% | KEV |
| largelikely tens of thousands of multi-tenant cPanel hosting servers (order of 10k-50k), with 100k+ tenant accounts behind them | |
| CVE-2026-54420 | Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild The LiteSpeed cPanel plugin, as distributed through the LiteSpeed WHM plugin, before version 2.4.8 (WHM plugin 5.3.2.0) mishandles UNIX symbolic links supplied by users (CWE-61). An attacker who already has FTP or web shell access to any account on a shared hosting server running CloudLinux/CageFS can plant a crafted symlink that the privileged plugin follows, letting them act beyond their own account scope — reportedly gaining root control of the entire server (CVSS scope change, C:H/I:H/A:H). Any hosting provider running vulnerable versions of the LiteSpeed cPanel/WHM plugin is affected, and because this is shared hosting, a single malicious tenant endangers other customers on the same server. The flaw was exploited in the wild in May 2026, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-15 (BOD 26-04 remediation obligations apply), and has a 1.4% 30-day EPSS; no public proof-of-concept is known. Do: Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later via the LiteSpeed WHM plugin 5.3.2.0 or later, following vendor instructions to meet CISA KEV/BOD 26-04 timelines. Until patched, restrict or monitor FTP and web shell access on affected shared hosting servers and review logs for signs of privilege escalation during and since May 2026; if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use. | 8.5 | 1% | KEV |
| largeest. tens of thousands of shared hosting servers (~10^4–10^5), each hosting many customer accounts |
Full article442 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 15, 2026
Critical LiteSpeed Enterprise flaw lets one shared hosting account gain root, bypassing CageFS; patch now to 6.3.7 via forced update.
cPanel warned that a critical flaw in LiteSpeed Enterprise can let a low‑privilege website user break out of their account and gain root on the whole server. On a box where dozens or hundreds of customers live side by side, that’s not a theoretical risk. It’s a full cross‑tenant compromise. Attackers could then access or modify other websites and the server itself.
“We have received notice that a critical privilege-escalation vulnerability has been identified in LiteSpeed Web Server Enterprise. On shared-hosting servers, a malicious low-privilege website user could potentially gain root-level access to the server. This could allow an attacker to access or alter other hosted websites and the server itself.” reads the advisory.
“This issue can bypass expected account isolation controls, including CageFS, allowing a malicious website user to potentially escape its restricted environment and gain root-level access to the server.”
The flaw affects versions before 6.3.7 and can bypass the isolation that keeps hosting accounts apart, including CageFS. CageFS is the CloudLinux layer that gives each account a restricted view of the filesystem so it can’t peek at other users or server configs.
If this flaw truly defeats that boundary, then one bad tenant can read or change other sites and take control of the machine.
Neither cPanel nor LiteSpeed disclosed technical details about the vulnerability. LiteSpeed’s September 11 announcement for 6.3.7 just mentions “Security improvements, bug fixes, and more!” and the changelog lists three security changes without calling out a privilege‑escalation issue.
There’s no CVE or severity rating yet, and it’s unclear whether attackers are already exploiting the flaw.
Both cPanel and LiteSpeed urge admins to run this command to update their installs:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
LiteSpeed warns that version 6.3.7 may take some time to reach the stable auto-update channel. As of September 15, the download page still listed 6.3.6 as the latest stable version. Forcing 6.3.7 means temporarily leaving the stable update channel, which can be restored later.
There’s no workaround for systems you can’t patch immediately. The advisory only covers the Enterprise edition; OpenLiteSpeed, the open‑source variant, had no matching update as of September 15.
LiteSpeed-related flaws have now been linked to three root-level escapes on cPanel shared-hosting servers since May.
This year, LiteSpeed fixed two flaws in its cPanel plugin, CVE-2026-48172 and CVE-2026-54420, which were being actively exploited in the wild. CISA added both issues to is Known Exploited Vulnerabilities catalog.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, LiteSpeed)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/199127/security/shared-hosting-at-risk-litespeed-enterprise-bug-can-grant-root-from-a-single-tenant.html