{"id":"CVE-2026-54420","kind":"vulnerability","aliases":["CVE-2026-54420"],"related":[],"title":"LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks…","description":"LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"The LiteSpeed cPanel plugin follows UNIX symbolic links in a way that lets a user with FTP or web shell access reach files outside their allowed area on a shared hosting server running CloudLinux/CageFS. CISA lists it as actively exploited, so an attacker with a hosting account can read or change files they should not reach.","severity":"high","cvss":8.5,"epss":null,"exploited":true,"exploited_at":"2026-06-15T00:00:00+00:00","products":[{"name":"LiteSpeed cPanel Plugin","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"litespeedtech litespeed cpanel plugin","fixed":["2.4.8"],"affected":"< 2.4.8","ecosystem":"vendor"},{"name":"litespeedtech litespeed whm plugin","fixed":["5.3.2.0"],"affected":"< 5.3.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cagefs","cloudlinux","cpanel","exploited","litespeed","shared-hosting","vendor"],"not_affected_if":["managed-hosting","no-litespeed-cpanel-plugin"],"how_to_check":"Check the installed LiteSpeed cPanel plugin version against the vendor advisory: unknown\nCISA KEV entry lists the affected product; confirm the plugin is installed on your cPanel hosts","fix":"Apply the vendor mitigation or update named in the vendor advisory; unknown in the sources\nIf no mitigation is available, discontinue use of the plugin per CISA BOD 26-04 guidance","status":"open","published_at":"2026-06-14T04:16:28+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:53+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:33:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or update named in the vendor advisory; unknown in the sources\nIf no mitigation is available, discontinue use of the plugin per CISA BOD 26-04 guidance","summary":"The LiteSpeed cPanel plugin follows UNIX symbolic links in a way that lets a user with FTP or web shell access reach files outside their allowed area on a shared hosting server running CloudLinux/CageFS. CISA lists it as actively exploited, so an attacker with a hosting account can read or change files they should not reach.","category":"vendor","who_cares":["cpanel","litespeed","shared-hosting","cloudlinux","cagefs"],"confidence":0.6,"analyst_note":"Find the vendor advisory, affected and fixed plugin versions, and the mitigation steps; the KEV page at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-54420 does not give them.","how_to_check":"Check the installed LiteSpeed cPanel plugin version against the vendor advisory: unknown\nCISA KEV entry lists the affected product; confirm the plugin is installed on your cPanel hosts\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-litespeed-cpanel-plugin"],"severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2245,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':144C,170C,201C '-2026':17A,20A '-54420':18A,21A '2.4.8':5A '26':143C,169C,200C '5.3.2.0':13A 'access':62B,119C 'accord':133C 'account':88B 'action':129C 'activ':80B 'adher':197C 'allow':67B,111C 'appli':130C 'applic':167C 'area':68B 'asset':191C 'attack':84B 'base':148C 'bod':142C,168C,199C 'cagef':33B 'chang':92B 'cisa':76B,127C,140C,157C 'cloud':173C 'cloudlinux':34B 'cloudlinux/cagefs':75B,126C 'complianc':138C 'contain':101C 'could':110C 'cpanel':2A,23A,27A,35B,44B,99C 'cve':16A,19A 'discontinu':176C 'distribut':7A 'ensur':137C,196C 'evalu':189C 'exploit':36B,81B 'exposur':194C 'file':64B,93B 'follow':46B,107C,166C 'forens':159C 'ftp':58B,115C 'guidanc':155C,171C 'guidelin':203C 'host':40B,72B,87B,123C 'instruct':136C 'internet':193C 'let':54B 'link':49B,105C 'list':77B 'litespe':1A,9A,37B,43B,98C 'litespeed':22A,26A,30A 'litespeedtech':25A,29A 'mishandl':14A 'mitig':131C,182C 'note':154C,165C 'outsid':65B 'patch':202C 'plugin':3A,11A,24A,28A,32A,45B,100C 'priorit':145C 'product':180C 'reach':63B,97B 'read':90B 'requir':128C,161C 'respons':187C 'risk':150C 'run':74B,125C 'secur':146C 'see':151C,162C 'server':73B,124C 'servic':174C 'share':39B,71B,122C 'shared-host':38B 'shell':61B,118C 'stakehold':185C 'symbol':48B,104C 'symlink':15A,106C 'triag':160C 'unavail':184C 'unix':47B,103C 'updat':147C 'url':152C,163C 'use':177C 'user':56B,113C 'vendor':41B,135C 'vulner':108C 'way':52B 'web':60B,117C 'whm':10A,31A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-14T04:16:28+00:00","kev":{"dateAdded":"2026-06-15","dueDate":"2026-06-18","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-54420","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-54420","severity":null,"published_at":"2026-06-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-54420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54420","severity":null,"published_at":"2026-06-14T04:16:28+00:00","modified_at":"2026-07-23T09:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}