Security Advisory: CloudLinux CageFS Mount Escape

What happened

CageFS gives every shared-hosting account its own virtualized file-system view so users cannot see each other’s files or the server’s internals. The mount escape flaw meant a determined local user could step outside that view — the isolation boundary that CageFS exists to provide on multi-tenant servers.

Who is affected

CloudLinux servers running CageFS, which is the standard setup on shared hosting. The actor here is local (an existing account holder), so exposure tracks with how many untrusted accounts a server hosts.

How to apply the fix

• Update the packages: yum update cagefs lvemanager
• Remount every user into the corrected cage: cagefsctl --restart-all

For SharedLicense customers

Licensing is unaffected — this is CloudLinux software. On shared platforms this update protects every tenant at once, which is why it is rated critical despite being a local flaw.