LiteSpeed Enterprise 6.3.7 Fixes Shared Hosting Root Flaw

A critical LiteSpeed Enterprise vulnerability can allow a low-privilege website user on a shared-hosting server to gain root access, the highest control level on a Linux machine, according to a cPanel advisory published on September 14. Shared hosting means many customers' websites run on a single physical server, and they are meant to be isolated from one another. The flaw breaks that isolation: an attacker with just one hosting account could use it to access or alter other sites and the server itself, the advisory warns.

cPanel said it received notice of the flaw, which affects LiteSpeed Web Server Enterprise versions before 6.3.7, and urged administrators to update to that release. LiteSpeed published version 6.3.7 on September 11. The vulnerability can bypass the controls that keep hosting accounts apart, including CageFS, cPanel said. CageFS is a CloudLinux tool that gives each hosting account a restricted view of the file system, so it cannot see other accounts or the server's configuration files. If CageFS is bypassed, a user in one account may see far more of the shared machine than intended.

Neither cPanel's advisory nor LiteSpeed's release notes describe how the flaw works. LiteSpeed's announcement of 6.3.7 called it a release with "Security improvements, bug fixes, and more!" Its changelog lists three security changes but does not mention a privilege-escalation flaw, and neither company has said publicly which change fixes it. The advisory carries no CVE identifier or severity score. A check of published CVE records on September 15 found none for this flaw, and the advisory does not say whether the flaw has already been exploited.

Both cPanel and LiteSpeed give the same command to install 6.3.7 now: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7. The manual update matters because version 6.3.7 may not arrive on its own. LiteSpeed said there "may be some delay" before the release reaches auto-update, the mechanism that automatically installs new versions. As of September 15, LiteSpeed's download page still listed 6.3.6 as the stable release, alongside a July pre-release build of 6.4.0 (RC1) whose changelog does not list the three security changes. cPanel's advisory does not say whether the 6.4.0 release candidates are affected. LiteSpeed's update documentation notes that forcing a specific version with this command stops the server from following its stable update tier, and administrators can resume automatic stable updates afterward by running touch /usr/local/lsws/autoupdate/follow_stable.

Neither cPanel's advisory nor LiteSpeed's release notes offer a workaround for servers that cannot update immediately, or indicators for checking whether a server has already been attacked. The advisory names only the Enterprise edition and does not address OpenLiteSpeed, LiteSpeed's open-source server, for which LiteSpeed had released no matching update as of September 15. This is the third time since May that a flaw in LiteSpeed software on cPanel servers has been reported to grant a hosting account root access, but it is the first in the web server itself, rather than in an add-on. In May and June, LiteSpeed disclosed two such flaws in its user-end cPanel plugin, CVE-2026-48172 and CVE-2026-54420. The company said both were being actively exploited and fixed both in the plugin. CISA later added both to its Known Exploited Vulnerabilities catalog. The Hacker News reported on those earlier flaws in May and June, and has now contacted LiteSpeed, cPanel, and CloudLinux with questions about this new one.

For website owners and hosting providers, the risk is not just one account being hijacked. A root-level compromise on a shared server can expose every website on that machine, including customer data, configuration files, and the server's own security settings. Keeping server software updated is the primary defense, but the rollout here is uneven: the fixed version exists, yet the stable download page still points to an older release, and auto-update may lag. This gap leaves shared-hosting customers dependent on their provider's speed in applying the manual update. Managed hosting services such as AEU Hosting, which provides managed WordPress hosting with end-to-end security, can lift that responsibility from site owners by handling server-side updates and security patching on their behalf.