CVE-2026-54420

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

CVSS v3.1

8.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

1.44% chance of exploitation in the next 30 days, 71th percentile

CISA KEV

added 2026-06-15

Published

2026-06-14

Updated

2026-06-16

Proof-of-concept exploits (2)

• HORKimhab/CVE-2026-544201★ · 2026-06-16
• fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit0★ · 2026-06-18

References

• CVE Record
• NVD entry

Related

• CVE-2023-21839
• CVE-2023-43654
• CVE-2024-21182
• CVE-2024-3094
• CVE-2024-42461
• CVE-2025-20343