Litespeedtech Openlitespeed vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Litespeedtech Openlitespeed: 2 record(s), with affected versions and fixes.
cpe:2.3:a:litespeedtech:openlitespeed

CVE-2026-104474 Medium · 6.7 CWE-367 Oct 2, 2026

OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

CVE-2026-31386 High · 7.2 CWE-78 Mar 16, 2026

OS Command Injection in Litespeedtech Litespeed Web Server

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.