Vulnerabilidades do Litespeedtech Openlitespeed

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Litespeedtech Openlitespeed: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:litespeedtech:openlitespeed

CVE-2026-104474 Média · 6.7 CWE-367 02/10/2026

OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

CVE-2026-31386 Alta · 7.2 CWE-78 16/03/2026

OS Command Injection em Litespeedtech Litespeed Web Server

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.