CVE-2026-54420 - LiteSpeed cPanel Plugin Symlink Privilege Escalation

⚠️ WARNING

This code is ONLY for educational purposes and authorized security testing. Unauthorized use against systems without explicit permission is ILLEGAL.

📋 Description

CVE-2026-54420 is a symlink privilege escalation vulnerability in the LiteSpeed plugin for cPanel (versions < 2.4.8) and WHM (versions < 5.3.2.0). A user with FTP or web shell access on a shared hosting server with CloudLinux/CageFS can create malicious symbolic links to read files outside their assigned directory, including:

/etc/passwd, /etc/shadow
Other users' configurations
Database files
SSH keys
Server configurations

Technical Details

🎯 Affected Versions

Product	Vulnerable Version	Fixed Version
LiteSpeed cPanel Plugin	< 2.4.8	2.4.8+
LiteSpeed WHM Plugin	< 5.3.2.0	5.3.2.0+

🔧 Installation

# Clonar repositorio
git clone https://github.com/username/CVE-2026-54420-LiteSpeed-Symlink-Exploit
cd CVE-2026-54420-LiteSpeed-Symlink-Exploit

# Instalar dependencias
pip install -r requirements.txt

# Dar permisos
chmod +x litespeed_symlink_exploit.py

CVE	CVE-2026-54420
CVSS	8.5 (HIGH)
Vector	AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE	61 - UNIX Symbolic Link (Symlink) Following
Product	LiteSpeed cPanel Plugin / WHM Plugin
Versions	< 2.4.8 / < 5.3.2.0
Environment	Shared hosting with CloudLinux/CageFS
Exploitation	Confirmed in the wild (May 2026)

CVE-2026-54420-LiteSpeed-Symlink-Exploit