CVE-2026-54420

Severity

HIGH

CVSS

8.5

EPSS

0.01439

Risk score

59.5

CISA KEV

Yes

PoC

Published

2026-06-14

Modified

2026-06-16

First seen

2026-08-05

Aliases

EUVD-2026-36657, GHSA-3G44-C4QC-CXM8

Products

LiteSpeed Technologies:cPanel Plugin 2.3 <2.4.8, LiteSpeed:cPanel Plugin, litespeedtech:litespeed_cpanel_plugin, litespeedtech:litespeed_whm_plugin

Sources

nvd CVE-2026-54420
cisa.gov CVE-2026-54420
euvd EUVD-2026-36657

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

References

https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/
https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://nvd.nist.gov/vuln/detail/CVE-2026-54420
https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36657