CVE-2026-54420

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Affected

LiteSpeed Technologies · cPanel Plugin

CVSS v3.1 MITRE

8.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.81% chance of exploitation in the next 30 days, 56th percentile

CISA KEV

added 2026-06-15

Published

2026-06-14

Updated

2026-06-16

Proof-of-concept exploits (2)

• HORKimhab/CVE-2026-544201★ · 2026-06-16
• fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit0★ · 2026-06-18

Security advisories

• https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2
• https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel

References

• CVE Record
• NVD entry

Related

• CVE-2023-21839
• CVE-2023-43654
• CVE-2024-21182
• CVE-2024-3094
• CVE-2024-42461
• CVE-2025-20343