Cpanel Plugin
Monthly
Symlink mishandling in LiteSpeed cPanel Plugin before 2.4.8 (and the bundling LiteSpeed WHM PlugIn before 5.3.2.0) lets a low-privileged tenant on a shared CloudLinux/CageFS host escape their per-user filesystem jail by planting symlinks the plugin follows with elevated privileges. The CVE record states the flaw was exploited against shared hosting providers in May 2026, and CVSS 8.5 with Scope:Changed reflects cross-tenant compromise of other customers' files on the same server. No separate KEV listing or public POC is present in the provided intelligence.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers abuse the plugin's Redis enable/disable functionality (the redisAble cpanel_jsonapi_func) to gain elevated, potentially root-level, access on the cPanel host. This flaw is confirmed actively exploited (CISA KEV) with in-the-wild activity observed in May 2026, publicly available exploit code exists (including a GitHub PoC), and the vendor scores it CVSS 4.0 10.0. Notably, the parent LiteSpeed WHM Plugin is not affected - only the end-user cPanel plugin.
Symlink mishandling in LiteSpeed cPanel Plugin before 2.4.8 (and the bundling LiteSpeed WHM PlugIn before 5.3.2.0) lets a low-privileged tenant on a shared CloudLinux/CageFS host escape their per-user filesystem jail by planting symlinks the plugin follows with elevated privileges. The CVE record states the flaw was exploited against shared hosting providers in May 2026, and CVSS 8.5 with Scope:Changed reflects cross-tenant compromise of other customers' files on the same server. No separate KEV listing or public POC is present in the provided intelligence.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers abuse the plugin's Redis enable/disable functionality (the redisAble cpanel_jsonapi_func) to gain elevated, potentially root-level, access on the cPanel host. This flaw is confirmed actively exploited (CISA KEV) with in-the-wild activity observed in May 2026, publicly available exploit code exists (including a GitHub PoC), and the vendor scores it CVSS 4.0 10.0. Notably, the parent LiteSpeed WHM Plugin is not affected - only the end-user cPanel plugin.