Joomla and LiteSpeed cPanel Vulnerabilities Exploited in Attacks
Summary
Attackers are exploiting Joomla JCE CVE-2026-48907 for code execution and LiteSpeed cPanel CVE-2026-54420 for privilege escalation. Both flaws have fixes; CISA added them to its Known Exploited Vulnerabilities catalog.
Key points
- CVE-2026-48907 affects JCE Pro versions before 2.9.99.5; attackers have exploited it to upload arbitrary files and execute PHP code.
- JCE Pro 2.9.99.5 addressed the flaw, and version 2.9.99.6 added protections. Joomla says exploitation is active, automated, and supported by public exploit code.
- Updating Joomla does not remove attacker files from systems already compromised; Joomla provided indicators of compromise for administrators to investigate.
- CVE-2026-54420 is a symlink-following flaw in the LiteSpeed user-end cPanel plugin that could let users with FTP or web shell access gain root privileges on affected shared hosting servers.
- LiteSpeed plugin versions before 2.4.8 are affected; the fixed version was released June 1, and exploitation has been observed since May.
- CISA added both flaws to its Known Exploited Vulnerabilities catalog, with federal patch deadlines of June 18 for LiteSpeed and June 19 for Joomla.
Article Details
- Vulnerability Types
- Improper access allowing unauthenticated attackers to upload editor profiles and arbitrary files, leading to PHP code execution
- UNIX symbolic link (symlink) following enabling privilege escalation to root
- Affected Versions
- JCE Pro versions before 2.9.99.5
- LiteSpeed user-end cPanel plugin versions before 2.4.8
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe LiteSpeed cPanel plugin symlink-following flaw enabled users with FTP or web shell access to escalate privileges to root.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-48907 in Joomla's JCE to upload files to servers and execute PHP code.
CVE
CVE-2026-48907joomlacontenteditor.net · Joomla Content Editor (JCE) extension for JoomlaAffecting the Joomla Content Editor (JCE) for Joomla and tracked as CVE-2026-48907, the first bug is described as an improper access issue that allows unauthenticated attackers to upload editor profiles.CVE-2026-54420LiteSpeed Technologies · cPanel PluginLiteSpeed’s user-end plugin for cPanel was found vulnerable to CVE-2026-54420, a UNIX Symbolic Link (symlink) following vulnerability.
Vendors
Products
CageFSDue to improper handling of symlinks, users with FTP or web shell access could elevate their privileges to root on the shared hosting servers running CloudLinux/CageFS.CloudLinuxDue to improper handling of symlinks, users with FTP or web shell access could elevate their privileges to root on the shared hosting servers running CloudLinux/CageFS.JCE editorAffecting the Joomla Content Editor (JCE) for Joomla and tracked as CVE-2026-48907, the first bug is described as an improper access issue that allows unauthenticated attackers to upload editor profiles.JCE ProAll JCE Pro versions before 2.9.99.5 are affected.JoomlaThreat actors are targeting vulnerabilities in Joomla and the LiteSpeed cPanel plugin for code execution and privilege escalation.