LiteSpeed Web Server vulnerabilities

2 known vulnerabilities in LiteSpeed Web Server from Litespeedtech. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  LiteSpeed Web Server: Double Decoding of the Same Data

  CVE-2026-93903Sep 30, 2026Litespeedtech

  LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

• 8.6 High severity

  OpenLiteSpeed: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-31386Mar 16, 2026LiteSpeed TechnologiesEPSS 1.61%

  OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.