CVE-2026-54420: LiteSpeed cPanel Path Traversal Flaw

CVE-2026-54420 Overview

CVE-2026-54420 affects the LiteSpeed cPanel plugin before version 2.4.8, distributed in the LiteSpeed WHM PlugIn before version 5.3.2.0. The plugin mishandles symbolic links provided by users with FTP or web shell access on shared hosting servers running CloudLinux/CageFS. Attackers have exploited this flaw in the wild since May 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. The weakness maps to CWE-61 (UNIX Symbolic Link Following) and enables cross-tenant compromise on multi-user shared hosting environments.

Critical Impact
Authenticated tenants on shared hosting can break out of CageFS isolation through symlink manipulation, gaining read and write access to files belonging to other users and to privileged host paths.

Affected Products

LiteSpeed cPanel plugin before 2.4.8
LiteSpeed WHM PlugIn before 5.3.2.0
Shared hosting servers running CloudLinux with CageFS isolation

Discovery Timeline

2026-06-01 - LiteSpeed Technologies publishes security update advisory
2026-06-14 - CVE-2026-54420 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54420

Vulnerability Analysis

The LiteSpeed cPanel plugin processes file paths on behalf of tenants on shared hosting servers. The plugin fails to validate whether paths supplied during plugin operations are symbolic links pointing outside the user's assigned CageFS jail. An authenticated tenant with FTP or web shell access can plant a symlink inside their own home directory that targets files owned by other tenants or by root. When the plugin performs privileged file operations, it dereferences the symlink and operates on the attacker-controlled target.

The issue is classified under CWE-61 (UNIX Symbolic Link Following). Because the plugin executes with elevated privileges outside CageFS confinement, the symlink dereference crosses the security boundary that CloudLinux is intended to enforce between tenants.

Root Cause

The plugin does not call lstat() or use O_NOFOLLOW semantics when handling tenant-supplied paths. It also does not verify that the canonical resolved path remains inside the user's home directory before performing reads, writes, or ownership changes. This combination allows a low-privileged tenant to redirect plugin file operations to arbitrary locations on the host filesystem.

Attack Vector

An attacker first obtains low-privilege access to a single cPanel account on a shared host through legitimate signup, credential theft, or an uploaded web shell. The attacker then creates a symbolic link inside their home directory pointing to a sensitive file such as /etc/shadow, another tenant's public_html directory, or a configuration file used by the LiteSpeed Web Server. The attacker triggers a LiteSpeed plugin action, such as a cache management or configuration write, that follows the symlink. The plugin executes the operation against the target file with its elevated privileges, enabling disclosure or modification of data outside the tenant's CageFS boundary. Refer to the LiteSpeed Blog Security Update for vendor technical details.

Detection Methods for CVE-2026-54420

Indicators of Compromise

Symbolic links inside tenant home directories targeting paths outside /home/<user>/, particularly /etc/, /root/, or other tenants' directories
LiteSpeed plugin log entries showing file operations on paths that resolve outside the invoking user's CageFS jail
Unexpected modifications to files owned by root or other tenants with mtimes correlating to plugin invocations
New or modified web shells in tenant directories that precede symlink creation events

Detection Strategies

Audit all tenant home directories for symlinks with find /home -type l -lname '/*' and flag links that escape the user's own tree
Correlate FTP and SSH session logs with subsequent LiteSpeed plugin activity to identify suspicious sequences
Monitor auditd rules tracking symlink and symlinkat syscalls executed by tenant UIDs
Compare LiteSpeed plugin version against 2.4.8 and the WHM PlugIn against 5.3.2.0 across all managed servers

Monitoring Recommendations

Enable verbose logging for the LiteSpeed cPanel and WHM plugins and forward logs to a centralized SIEM
Alert on any plugin file operation that resolves outside the invoking tenant's home directory after realpath() normalization
Track CageFS namespace transitions and flag plugin processes that read or write outside expected mount points
Review the CISA Known Exploited Vulnerabilities catalog entry for federal reporting timelines

How to Mitigate CVE-2026-54420

Immediate Actions Required

Upgrade the LiteSpeed cPanel plugin to version 2.4.8 or later on every shared hosting server
Upgrade the LiteSpeed WHM PlugIn to version 5.3.2.0 or later
Audit all tenant home directories for malicious symlinks and remove links that escape their jail
Rotate credentials and review web server access logs for any tenant account suspected of exploitation

Patch Information

LiteSpeed Technologies released fixed versions on 2026-06-01. The LiteSpeed Blog Security Update documents the patched releases. Administrators using the WHM-managed installer should run the standard plugin update workflow to pull litespeed_cpanel_plugin 2.4.8 and litespeed_whm_plugin 5.3.2.0. Confirm versions after upgrade through the WHM interface or by inspecting the plugin manifest. Additional product information is available in the LiteSpeed cPanel Support Overview.

Workarounds

Disable the LiteSpeed cPanel plugin on affected servers until patching completes
Restrict FTP write access and disable any unused web shell or file manager features for tenants
Apply stricter CageFS mount options that prevent following symlinks across namespace boundaries
Add filesystem ACLs that deny tenant UIDs from creating symlinks targeting paths outside their home directory

bash

# Configuration example
# Verify plugin versions after upgrade
/usr/local/cpanel/whostmgr/docroot/cgi/lsws/lsws.cgi --version

# Audit tenant home directories for escaping symlinks
find /home -type l -exec sh -c '
  for link; do
    target=$(readlink -f "$link")
    owner_home=$(dirname "$(dirname "$link")")
    case "$target" in
      "$owner_home"/*) ;;
      *) printf "ESCAPE: %s -> %s\n" "$link" "$target" ;;
    esac
  done
' _ {} +

# auditd rule to track symlink creation by tenants
auditctl -a always,exit -F arch=b64 -S symlink -S symlinkat -F auid>=1000 -k tenant_symlinks