Critical LiteSpeed Enterprise Flaw Hands Out Root on Shared Hosting

On September 14, cPanel issued an advisory about a critical vulnerability in LiteSpeed Web Server Enterprise. According to the company, a low-privileged user — that is, the owner of an ordinary web-hosting account — can gain root privileges on a shared-hosting server.

The defining trait of shared hosting is that the sites of many customers run on a single physical machine. Isolation between them is provided, among other things, by mechanisms such as CageFS — a CloudLinux tool that gives each account a stripped-down view of the file system so that it sees neither other accounts nor the server's configuration. The vulnerability, cPanel claims, makes it possible to bypass these barriers and reach other people's sites and the server itself.

A patch exists, details don't

All versions up to 6.3.7 are affected; administrators are urged to update immediately to that release, which LiteSpeed published on September 11. Neither cPanel nor the developer itself explains how exactly the defect works. LiteSpeed's announcement of version 6.3.7 modestly calls it a set of “security improvements, fixes, and more.” The changelog lists three security fixes, but there is no mention of privilege escalation, and neither company has publicly said which of them closes the hole.

The vulnerability has not been assigned a CVE identifier or a severity score; as of September 15, no corresponding entry could be found in the CVE databases. Nor is there any word on whether it has been exploited in real-world attacks.

Both companies recommend the same method of manual installation — the command /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7. A manual update here is no formality: LiteSpeed warned that the new version will reach auto-update “with some delay.” As of September 15, the downloads page still listed 6.3.6 as the stable version. At the same time, forcibly pinning the version takes the server out of the stable update channel — you can return to it by creating a file with the command touch /usr/local/lsws/autoupdate/follow_stable.

Neither a temporary workaround for those who cannot update immediately nor any indicators of compromise has been offered by either company. The advisory concerns only the Enterprise edition; there is no mention of the open-source OpenLiteSpeed, for which no fix had been released at the time.

The third time since May

This is already the third case since May in which a defect in LiteSpeed software on cPanel servers grants a hosting account root privileges, but the first in the web server itself. Earlier, in May and June, LiteSpeed disclosed two similar vulnerabilities in the client-side plugin for cPanel (CVE-2026-48172 and CVE-2026-54420), acknowledged their active exploitation, and fixed them; both later made it into CISA's catalog of known exploited vulnerabilities.

Source: The Hacker News