CVE-2026-54420

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell…

High Known exploited

Severity: 8.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.44%; Chance of exploitation in the next 30 days. Higher than 73.17% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Jun 15, 2026
Weakness: CWE-61 UNIX Symbolic Link (Symlink) Following
Fix: None yet; No fixed version published

Exploited in the wild. LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability (LiteSpeed cPanel Plugin). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Jun 18, 2026.

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 8.5

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-61: UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

How to prevent it

Implementation: Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References

Advisories

blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2

Timeline

Jun 14, 2026 Published
Jun 15, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Jun 18, 2026 Remediation due for U.S. federal agencies
Jul 23, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-hjqx-j4rw-g7xv zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.	High	Same weakness, CWE-61
GHSA-p8v3-89rh-jxc7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied	High	Same weakness, CWE-61
GHSA-f794-5jv7-7672 NLTK: Downloader.download follows hardlinks and overwrites outside-root files	High	Same weakness, CWE-61
RUSTSEC-2026-0269 Filesystem sandbox escape when paths or symlinks contain trailing slashes	High	Same weakness, CWE-61
GO-2026-4970 Root escape via symlink plus trailing slash in os	High	Same weakness, CWE-61
GHSA-jmr9-qjv8-65gv extract-zip unvalidated symlink path traversal	High	Same weakness, CWE-61
GHSA-89mr-xqfv-758m Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym	Critical	Same weakness, CWE-61
GHSA-ccv6-r384-xp75 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit	Critical	Same weakness, CWE-61

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor