What is the CVSS score of CVE-2026-54420?

CVE-2026-54420 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of LiteSpeed cPanel Plugin are affected by CVE-2026-54420?

The LiteSpeed cPanel Plugin (versions before 2.4.8) and LiteSpeed WHM Plugin (versions before 5.3.2.0) contain a symlink-handling vulnerability allowing low-privileged tenants in shared hosting…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54420?

Yes, a public proof-of-concept exploit is available for CVE-2026-54420. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-54420?

Within 24 hours: Inventory all systems running affected LiteSpeed versions (cPanel Plugin before 2.4.8; WHM Plugin before 5.3.2.0) and quantify exposure scope. Within 7 days: Establish and validate compensating controls, audit CloudLinux/CageFS filesystem jail configuration, and contact LiteSpeed for patch availability timeline. Within 30 days: Implement interim mitigations, conduct forensic analysis of filesystem access logs for unauthorized symlink activity and cross-tenant file access, and develop upgrade or alternative migration plan pending vendor patch release.

LiteSpeed cPanel Plugin CVE-2026-54420

EUVD-2026-36657 HIGH

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-06-14 mitre

GHSA-3g44-c4qc-cxm8

Information Disclosure Cpanel Plugin

8.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Attacker needs an existing tenant account with local filesystem write inside CageFS (PR:L, AV:L), exploitation depends on specific CageFS setup and race timing (AC:H), and symlink escape breaks the cage's security authority (S:C, C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jun 15, 2026 - 19:31 CISA

Patch available

Jun 14, 2026 - 05:00 EUVD

Analysis Generated

Jun 14, 2026 - 04:12 vuln.today

CVE Published

Jun 14, 2026 - 03:23 cve.org

HIGH 8.5

DescriptionCVE.org

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Articles & Coverage 1

POC CVE-2026-54420: CISA-Flagged LiteSpeed cPanel Plugin Vulnerability PoC Released Jun 16, 2026

AnalysisAI

Symlink mishandling in LiteSpeed cPanel Plugin before 2.4.8 (and the bundling LiteSpeed WHM PlugIn before 5.3.2.0) lets a low-privileged tenant on a shared CloudLinux/CageFS host escape their per-user filesystem jail by planting symlinks the plugin follows with elevated privileges. The CVE record states the flaw was exploited against shared hosting providers in May 2026, and CVSS 8.5 with Scope:Changed reflects cross-tenant compromise of other customers' files on the same server. No separate KEV listing or public POC is present in the provided intelligence.

Technical ContextAI

The vulnerability is a classic CWE-61 (UNIX Symbolic Link Following) issue. CloudLinux's CageFS provides each shared-hosting user with a virtualized, per-tenant view of the filesystem so processes cannot reach other users' home directories. The LiteSpeed cPanel plugin (CPE cpe:2.3:a:litespeed_technologies:cpanel_plugin) runs outside the cage with higher privileges to perform administrative actions across vhosts; when it accesses files in a tenant's directory it apparently resolves symlinks without verifying that the target stays inside the caller's CageFS root. A user with write access inside the cage (via FTP or a web shell on a hacked account) can therefore swap a regular file for a symlink pointing to /home/<other_user>/ paths or system files, and have the privileged plugin read or write them on the attacker's behalf.

RemediationAI

Vendor-released patch: upgrade the LiteSpeed cPanel Plugin to 2.4.8 or later, which on WHM installations corresponds to LiteSpeed WHM PlugIn 5.3.2.0 or later, per https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ and the product page at https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel. Where immediate upgrade is not possible, compensating controls include suspending or disabling tenant FTP and web shell access for untrusted accounts (which breaks legitimate self-service), enabling CloudLinux's symlink-owner-match protection (fs.protected_symlinks=1 plus CageFS's symlinkowner option) so the kernel refuses cross-owner symlink traversal even by privileged processes, and auditing CageFS skeleton mounts for plugin-invoked paths; note these controls reduce but do not fully eliminate the privileged plugin code path that follows the symlinks. Rotate credentials and review logs for any tenant suspected of having been used as the foothold.