CVE-2026-54420

LiteSpeed · Published June 14, 2026

8.5

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Affected Products

Litespeed Cpanel Plugin < 2.4.8
Litespeed WHM Plugin < 5.3.2.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H