CVE-2026-54420

LiteSpeed cPanel plugin allows attackers to traverse symlink chains to escape shared hosting isolation on CloudLinux/CageFS.

This symlink following vulnerability in the LiteSpeed cPanel plugin enables attackers with FTP or web shell access to bypass shared hosting isolation on CloudLinux/CageFS environments. DIB organizations using LiteSpeed cPanel plugins face elevated risk of lateral movement and data exfiltration from compromised shared servers, requiring immediate patching and isolation verification.

Shame score — A known symlink traversal vulnerability in a widely-used cPanel plugin that allows isolation bypass on shared hosting platforms.