What’s Vulnerable › Vulnerabilities

CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-06-15
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-14 · updated 2026-07-23
• Weakness: CWE-61

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Affected products

• litespeedtech Litespeed Cpanel Plugin: before 2.4.8 — fixed in 2.4.8
• litespeedtech Litespeed Whm Plugin: before 5.3.2.0 — fixed in 5.3.2.0

How to fix

Upgrade to a fixed version: litespeedtech Litespeed Cpanel Plugin 2.4.8; litespeedtech Litespeed Whm Plugin 5.3.2.0. Check the vendor advisory for mitigations.

References

• https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/
• https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420

Get alerted when CVE-2026-54420 or the next vulnerability affects your stack