Security Advisory

CVE-2026-54420

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-14 03:23:12

Last updated 2026-06-16 03:56:05

Assigner mitre

CVSS score 8.5

State PUBLISHED

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

← Browse all CVEs View on cve.org ↗