← Database

CVE-2026-54420

HIGH CVSS: 8.5 Published: 2026-06-14 Modified: 2026-07-23

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Affected Platforms

Litespeedtech Litespeed Whm PluginLitespeedtech Litespeed Cpanel Plugin

Weakness Type

CWE-61

References