A critical privilege escalation vulnerability in LiteSpeed Web Server Enterprise could allow an attacker who controls a single low-privilege account on a shared hosting server to gain full root access to the underlying machine — and, by extension, to every other website and account hosted on it. cPanel issued a security advisory on September 14 warning administrators to update immediately, describing the flaw as allowing a low-privilege website user to escalate to root. LiteSpeed released the patched version, 6.3.7, on September 11 ahead of the advisory.
Neither cPanel’s advisory nor LiteSpeed’s changelog describes the technical mechanism of the flaw or how the privilege escalation is achieved, and neither organization has said whether it has been exploited in the wild. Auto-update delivery of 6.3.7 may be delayed, so LiteSpeed and cPanel are both urging manual installation. The impact is significant for any hosting provider that runs LiteSpeed Enterprise on multi-tenant infrastructure: a single malicious or compromised customer account could pivot to full server control, exposing every tenant.
How to check if you’re affected
Affected versions are LiteSpeed Web Server Enterprise releases before 6.3.7. To update immediately, run the following command on the server:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
The manual update bypasses any delay in the auto-update pipeline. After updating, verify the installed version is 6.3.7 via the LiteSpeed admin panel or by running /usr/local/lsws/bin/lswsctrl version.