The LiteSpeed cPanel plugin misinterprets symbolic links created by an attacker with FTP or web shell access on a shared hosting environment running CloudLinux/CageFS. By placing a symlink that points to files outside the intended directory, the plugin can read or execute arbitrary files, potentially allowing an attacker to read sensitive system files or run arbitrary code on the server. This flaw is a path‑traversal vulnerability (CWE‑61).

This issue affects LiteSpeed Technologies' cPanel plugin versions prior to v2.4.8, which are distributed as part of the LiteSpeed WHM PlugIn v5.3.1 and earlier. Users of these plugin versions on shared hosting servers that run CloudLinux/CageFS are in scope.

The CVSS score of 8.5 reflects a high severity vulnerability. Because the vulnerability requires the attacker to have FTP or web shell write access, it is limited to users who already operate within the hosting environment, but it can be leveraged for remote code execution once the symlink is in place. The EPSS score is not available, but the active exploitation of the vulnerability in May 2026 indicates a real threat. The vulnerability is not listed in CISA KEV.