Read the docs
TI-2026-63206 Aliases CVE-2026-93903GHSA-8x5w-4247-99g6

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL…

Priority MEDIUM 42CWE-174Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed LiteSpeed Web Server (litespeedtech): 6.3.7 build 1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
litespeedtechLiteSpeed Web Serverbefore 6.3.7 build 16.3.7 build 1Patch availableCNA
  • LiteSpeed Web Server Vendorlitespeedtech Affected before 6.3.7 build 1 Fixed in 6.3.7 build 1 Patch available CNA

Remediation

  • Fix · CNA LiteSpeed Web Server (litespeedtech) Fixed in 6.3.7 build 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93903
  2. 2026-10-03 Alias added: GHSA-8x5w-4247-99g6
  3. 2026-10-29 1 new reference · CNA
  4. 2026-11-05 Title updated · CNA
  5. 2026-11-05 1 new reference · CNA

References

Advisory 1

Other 3

  • TI-2026-35606 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to… KEVCVSS 4.0CRITICAL 10.0
  • TI-2026-39296 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before… KEVCVSS 3.1HIGH 8.5
  • TI-2024-29589 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-18601 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-00030 Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVSS 3.1HIGH 8.8
  • TI-2026-83023 Client certificate bypass over HTTP/3 in OpenLiteSpeed CVSS 4.0HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences