PT-2026-49104 · Whm+1 · Litespeed Whm Plugin+1
CVE-2026-54420
·
Published
2026-06-14
·
Updated
2026-07-12
CVSS v3.1
8.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LiteSpeed cPanel plugin versions prior to 2.4.8
LiteSpeed WHM PlugIn versions prior to 5.3.2.0
Description
A privilege escalation issue exists where the software mishandles symbolic links (symlinks) provided by a user with FTP or web shell access on shared hosting servers running CloudLinux/CageFS. This flaw allows an attacker to gain root access. The issue was exploited in the wild in May 2026.
Recommendations
Update LiteSpeed cPanel plugin to version 2.4.8 or later.
Update LiteSpeed WHM PlugIn to version 5.3.2.0 or later.
Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Litespeed Whm Plugin
Litespeed Cpanel Plugin