CVE-2026-54420: LiteSpeed cPanel plugin before 2

Synopsis

This is a symlink-handling vulnerability in the LiteSpeed cPanel plugin before version 2.4.8 (distributed as part of LiteSpeed WHM PlugIn before 5.3.2.0). An attacker with low-privilege access, such as an FTP account or web shell on a shared hosting server running CloudLinux/CageFS, can supply crafted symlinks to escape their sandboxed environment and reach files outside their intended scope. Successful exploitation allows the attacker to read, modify, or destroy data across the host system, and this vulnerability has been exploited in the wild as of May 2026. A patched-image rebuild at version 2.4.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network; the vulnerability is exposed on internet-facing shared hosting infrastructure.

• AuthenticationRequired

  A low-privilege account is sufficient; FTP credentials or web shell access on the shared hosting server is enough to trigger the symlink mishandling.

• Victim interactionNot required

  No action from any other user or administrator is needed to complete the attack.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker may need to account for environmental factors such as specific CageFS configurations or timing conditions to successfully escape the sandbox.

Blast Radius

• Reads arbitrary files on the host system outside the attacker's CageFS sandbox, including credentials, configuration files, and data belonging to other hosting accounts.
• Modifies or overwrites files across the host, enabling tampering with other tenants' web content, configuration, or application data.
• Destroys files outside the attacker's intended scope, causing data loss for co-hosted tenants or disrupting host-level services.
• Achieves full compromise of confidentiality, integrity, and availability at the host level due to CVSS C:H/I:H/A:H with Changed scope.