High severity · published Jun 14, 2026
CVE-2026-54420
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
In wildKEV
8.5
CVSS
1.4%
EPSS
Yes
On KEV
Description
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 15, 2026
Federal remediation dueJun 18, 2026
Ransomware campaign useNot known
Affected products
Which versions
CP
cPanel Plugin · LiteSpeed Technologies
2.3 before 2.4.8 · source: vendor, KEV
LC
Litespeed Cpanel Plugin · Litespeedtech
before 2.4.8 · source: NVD
LW
Litespeed Whm Plugin · Litespeedtech
before 5.3.2.0 · source: NVD
In the news
VulnerabilityHigh
[CISA KEV] CVE-2026-54420: LiteSpeed cPanel Plugin - LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.
CPcPanel PluginCVE-2026-54420
Jun 15, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54420
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54420
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.litespeedtech.com
https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
blog.litespeedtech.com
https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/
More from cPanel Plugin
9.8
CVE-2026-48172
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability