Vulnerability

CERT-In Vulnerability Note CIVN-2026-0271
Privilege Escalation Vulnerability in LiteSpeed cPanel Plugin

Original Issue Date:May 27, 2026

Severity Rating: CRITICAL

Software Affected

LiteSpeed User-End cPanel Plugin versions prior to 2.4.5

Overview

A vulnerability has been reported in LiteSpeed cPanel Plugin which could allow an attacker to gain elevated privileges on the targeted system.

Target Audience:
Web hosting providers, server administrators, and cPanel users managing LiteSpeed-powered shared hosting environments.

Risk Assessment:
High risk of privilege escalation, full server compromise.

Impact Assessment:
Potential for root-level access, server compromise, disruption of hosted services.

Description

LiteSpeed User-End cPanel Plugin is a management plugin that allows users to manage LiteSpeed Web Server features directly through the cPanel interface.

A vulnerability exists in the LiteSpeed cPanel Plugin due to an error in the lsws.redisAble function.

Successful exploitation of this vulnerability could allow an attacker to gain elevated privileges on the targeted system.

Solution

Apply appropriate updates as mentioned:
https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/

Vendor Information

https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/

References

https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/

CVE Name
CVE-2026-48172

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India