Back to Security Advisories

Security Advisory: CloudLinux CageFS Mount Escape

A mount escape in CloudLinux CageFS — the virtualized per-user file system that isolates shared hosting accounts from each other — is fixed in this security release: a local user could break past the CageFS view toward cross-account exposure. Update CageFS and remount all users.

Critical
CloudLinux CloudLinux 7 CloudLinux 8 CloudLinux 9

Affected Versions

CageFS 7.4.1 and earlier

Patched Version

CageFS 7.4.3

Default Update CMD

yum update -y

Fix Commands

CloudLinux 9

yum update cagefs
/usr/sbin/cagefsctl --force-update

CloudLinux 8

yum update cagefs
/usr/sbin/cagefsctl --force-update

CloudLinux 7

yum update cagefs
/usr/sbin/cagefsctl --force-update

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in CloudLinux 7, CloudLinux 8 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

CageFS gives every shared-hosting account its own virtualized file-system view so users cannot see each other’s files or the server’s internals. The mount escape flaw meant a determined local user could step outside that view — the isolation boundary that CageFS exists to provide on multi-tenant servers.

Who is affected

CloudLinux servers running CageFS, which is the standard setup on shared hosting. The actor here is local (an existing account holder), so exposure tracks with how many untrusted accounts a server hosts.

How to apply the fix

  • Update the packages: yum update cagefs lvemanager
  • Remount every user into the corrected cage: cagefsctl --restart-all

For SharedLicense customers

Licensing is unaffected — this is CloudLinux software. On shared platforms this update protects every tenant at once, which is why it is rated critical despite being a local flaw.

Frequently Asked Questions

What is CageFS?
CloudLinuxu2019s per-user virtualized file system that keeps shared hosting accounts isolated from each other and from server internals.
Why is a local flaw rated critical?
On shared hosting, any account holder is a local user — the flaw breaks the isolation the whole product depends on.
What commands apply the fix?
yum update cagefs lvemanager, then cagefsctl --restart-all to remount all users.

References

Security Advisories

Related Advisories

Vulnerabilities in the ea-nodejs22 package (October 2026 Node.js security releases)

2026-10-21

cPanel CVE-2026-87899: Privilege Escalation

2026-09-23 00:00:00

WP Toolkit for cPanel CVE-2026-87900

2026-09-23 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System