LiteSpeed Enterprise Flaw Lets Shared-Hosting Accounts Gain Root Access

cPanel warned that an undisclosed critical privilege-escalation flaw in LiteSpeed Web Server Enterprise before version 6.3.7 could allow a low-privilege shared-hosting account to bypass tenant-isolation controls, including CloudLinux CageFS, and obtain root access to the host. Successful exploitation could expose other customers’ websites, server configuration, and the underlying shared server.

LiteSpeed released version 6.3.7, and cPanel urged administrators to install it manually because automatic-update availability may be delayed. No CVE, severity score, technical root cause, workaround, indicators of compromise, or confirmed exploitation status has been published; the advisory applies to the Enterprise edition, while exposure of OpenLiteSpeed and 6.4.0 release candidates remains unconfirmed.