CVE-2026-54420
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
Description
CVE-2026-54420 is a high-severity symlink-following vulnerability in the LiteSpeed cPanel plugin (as distributed in the LiteSpeed WHM PlugIn). On shared hosting servers running CloudLinux/CageFS, the plugin mishandles symbolic links provided by a user who has FTP or web shell access, allowing that low-privileged tenant to break the isolation between accounts. Because the attack crosses a security boundary (the per-account CageFS sandbox), CVE-2026-54420 is rated CVSS 8.5 (High) with a changed scope and was exploited in the wild in May 2026. It affects the LiteSpeed cPanel plugin before 2.4.8 (LiteSpeed WHM PlugIn before 5.3.2.0). Shared hosting providers running LiteSpeed should treat this symlink vulnerability as a priority because it enables one tenant to affect files belonging to others or the host.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| litespeedtech | litespeed cpanel plugin | < 2.4.8 |
| litespeedtech | litespeed whm plugin | < 5.3.2.0 |
References
- https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/(Vendor Advisory)
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420(US Government Resource)
Weakness Type
CWE-61: UNIX Symbolic Link (Symlink) Following
CVE-2026-54420 maps to CWE-61 — UNIX Symbolic Link (Symlink) Following. The LiteSpeed cPanel plugin follows symbolic links supplied by a local tenant without verifying that the link target stays within the user's permitted directory, so a crafted symlink causes the privileged plugin to operate on files outside the CageFS sandbox. This is a classic symlink race/follow weakness in which the trusted component dereferences an attacker-controlled link.
Learn more: CWE-61 — UNIX Symbolic Link (Symlink) Following
Impact Analysis
CVE-2026-54420 carries a CVSS 3.1 base score of 8.5 (High). Attack Vector (Network): the affected hosting service is reachable over the network. Attack Complexity (High): exploitation depends on conditions such as winning a symlink timing window, so it is not trivial. Privileges Required (Low): the attacker must already be a tenant with FTP or web shell access on the shared server. Scope (Changed): the impact extends beyond the attacker's own CageFS jail to resources belonging to other accounts or the host. Confidentiality, Integrity and Availability (High): by redirecting privileged file operations through symlinks, an attacker can read, modify, or destroy files outside their own account. Although the EPSS score is modest (about 0.7%), the vulnerability was confirmed exploited in the wild, so shared hosting operators face real risk of cross-tenant compromise.
Exploit Maturity
CISA has added CVE-2026-54420 to the Known Exploited Vulnerabilities catalog, and the vendor confirms it was exploited in the wild in May 2026. No standalone public exploit link is listed in the references, and the EPSS score is relatively low at about 0.7% (46th percentile), but documented real-world exploitation outweighs the modest EPSS figure. Shared hosting providers should treat the vulnerability as actively exploited and patch promptly.
Remediation
- Apply the vendor fix per CISA's required action: upgrade the LiteSpeed cPanel plugin to 2.4.8 or later, and the LiteSpeed WHM PlugIn to 5.3.2.0 or later.
- On shared servers, prioritize patching where untrusted tenants have FTP or web shell access, as these are the prerequisites for exploitation.
- As an interim measure, tighten CageFS configuration and restrict or monitor symlink creation by tenants until the plugin is updated.
- Review file integrity across accounts and host paths for evidence of cross-tenant file access or modification dating back to at least May 2026.
- As long-term hardening, ensure privileged plugins resolve and validate canonical paths before file operations and refuse to follow symlinks that escape the tenant's directory.
Technical Details
The flaw is a symlink-following weakness (CWE-61): the LiteSpeed cPanel plugin performs privileged file operations but dereferences symbolic links created by a local tenant without confirming the resolved target remains inside the account's CageFS boundary. Reflected in the CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, an authenticated low-privilege user with FTP or web shell access plants a symlink pointing outside their jail; when the plugin processes it, the operation is carried out with the plugin's privileges against the link target. The high attack complexity reflects the timing or environmental conditions needed, while the changed scope captures the move from the attacker's sandbox to other tenants or the host filesystem.
Frequently Asked Questions
Is CVE-2026-54420 being actively exploited?
Yes. It is listed in CISA's Known Exploited Vulnerabilities catalog, and the vendor advisory states it was exploited in the wild in May 2026. The EPSS score is low (about 0.7%), but confirmed real-world exploitation is the more important signal.
What products are affected by CVE-2026-54420?
The LiteSpeed cPanel plugin before 2.4.8 and the LiteSpeed WHM PlugIn before 5.3.2.0 are affected, specifically on shared hosting servers running CloudLinux/CageFS.
How do I fix CVE-2026-54420?
Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later and the LiteSpeed WHM PlugIn to 5.3.2.0 or later. Prioritize servers where untrusted tenants have FTP or web shell access.
How severe is CVE-2026-54420?
It is rated High with a CVSS 3.1 base score of 8.5 and a changed scope, meaning a single tenant can affect other accounts or the host. Combined with confirmed in-the-wild exploitation, it warrants prompt remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.