CVE-2026-54420
EUVD-2026-3665714.06.2026, 04:16
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| litespeedtech | litespeed_cpanel_plugin | 𝑥 < 2.4.8 |
| litespeedtech | litespeed_whm_plugin | 𝑥 < 5.3.2.0 |
𝑥
= Vulnerable software versions