LiteSpeed Technologies vulnerabilities
We track 9 vulnerabilities in LiteSpeed Technologies products across 7 products. 9 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on June 14, 2026.
Latest LiteSpeed Technologies vulnerabilities
- 8.5 High severity
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Exploited
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
- 9.8 Critical severity
LiteSpeed cPanel Plugin Privilege Escalation Exploited
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2
- 8.6 High severity
OpenLiteSpeed: Improper Neutralization of Special Elements used in an OS Command
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
- 9.8 Critical severity
LiteSpeed Cache: Inadequate Encryption Strength
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.
- 9.8 Critical severity
LiteSpeed Cache: Insufficiently Protected Credentials
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.
- 8.8 High severity
LiteSpeed Cache: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.
- 9.8 Critical severity
LiteSpeed Cache: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
- 8.8 High severity
OpenLiteSpeed Web Server: Untrusted Search Path
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1.
- 8.8 High severity
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and…
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.