LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

A critical vulnerability in LiteSpeed Web Server Enterprise, affecting versions prior to 6.3.7, could allow a low-privileged hosting account user to escalate privileges and gain root access on shared servers. This flaw bypasses isolation mechanisms such as CageFS, potentially enabling attackers to access or modify other hosted websites and server configurations. Although cPanel and LiteSpeed have issued an advisory and released version 6.3.7 to address the issue, neither has disclosed technical details, a CVE identifier, or indicators of compromise. The vulnerability has not been publicly exploited as of the report date, but it marks the first such flaw in the web server itself, following two previously exploited flaws in LiteSpeed's cPanel plugin.

AI-extracted · verify before operational use