LiteSpeed vulnerability allows root access on shared hosts

A critical vulnerability in LiteSpeed Web Server Enterprise has been identified, potentially allowing low-privilege users to gain root access on shared-hosting servers. The flaw is capable of bypassing security controls such as CloudLinux’s CageFS, which is designed to isolate hosting accounts.

cPanel has urged administrators to manually update to LiteSpeed version 6.3.7, as there may be delays in the automatic update process. This marks the third time since May that a flaw in LiteSpeed software on cPanel servers has been reported to grant root access, though this is the first instance involving the web server itself. As of mid-September, no CVE identifier or specific severity score has been officially published for this particular flaw.