VULNERABILITY INTELLIGENCE

CVE-2026-54420

CVSS score8.5 HIGH
EPSS probability1.44%
CISA KEVKnown exploited vulnerability
Published2026-06-14
Last modified2026-07-23
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Vendor / product: LiteSpeed / cPanel Plugin

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Weakness classification

  • cve@mitre.org: CWE-61

Primary references