CVE-2026-54420: LiteSpeed cPanel plugin symlink following on shared hosting

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is confirmed exploited in the wild and listed in CISA KEV with a near-term remediation deadline, despite a modest CVSS base score of 8.5 and low EPSS.

What it is

The LiteSpeed cPanel plugin before 2.4.8 (and LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks supplied by a user who has FTP or web shell access on a shared hosting server running CloudLinux/CageFS. Because the flaw crosses a security boundary on shared infrastructure, a low-privileged tenant can affect files outside their own account. It was exploited in the wild in May 2026 and added to CISA KEV.

Impact

An attacker with FTP or web shell access can follow attacker-controlled symlinks to read or write files outside their hosting account, gaining high confidentiality, integrity and availability impact on other tenants or the host. The scope change in the CVSS vector reflects that the compromise can extend beyond the vulnerable component.

Attack surface

Reachable over the network through the cPanel/WHM plugin interface, but it requires the attacker to already hold a low-privileged account with FTP or web shell access on the shared server. No user interaction is needed; the vector is AV:N/AC:H/PR:L/UI:N/S:C.

Exploitation

Listed in CISA KEV with a due date of 2026-06-18 and described as exploited in the wild in May 2026, so active exploitation is confirmed. EPSS is low at 0.01439 (71.8th percentile), which understates the risk given the KEV entry.

What to do

• Update the LiteSpeed cPanel plugin to 2.4.8 or later and the LiteSpeed WHM PlugIn to 5.3.2.0 or later, per the vendor advisory.
• If patching cannot be completed by the CISA due date, apply the vendor's interim mitigations or discontinue use of the plugin on shared hosting servers.
• Audit shared hosting accounts for unnecessary FTP and web shell access, and remove or restrict it where not required.
• Verify CloudLinux/CageFS protections are enabled and current, since the flaw abuses symlink handling within that isolation model.
• Track remediation against CISA BOD 26-04 requirements for internet-exposed assets.

Detection

• Review cPanel/WHM and LiteSpeed plugin logs for symlink creation or access activity originating from low-privileged hosting accounts.
• Hunt for file access or writes outside a tenant's home directory that traverse symlinks, especially in shared hosting environments.
• Monitor for unexpected changes to files owned by other accounts or the host on CloudLinux/CageFS servers.
• Correlate FTP and web shell session activity with subsequent cross-account file operations on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.