Skip to content

Vendor

LiteSpeed Technologies vulnerabilities

22 published CVES affecting LiteSpeed Technologies, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
22
Critical
4
High
8
Medium
10
Low
0
Unscored
0
CISA KEV
2
Atom feed of LiteSpeed Technologies alerts

Products

Latest LiteSpeed Technologies CVEs

Newest publication first

  2. CVE-2026-54420 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running Clou...

    Published
    HighCVSS 8.5 EPSS 1.4% CISA KEV added 2026-06-15 Exploited in the wild

    LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

  3. CVE-2026-48172 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonap...

    Published
    CriticalCVSS 10.0 EPSS 17.9% CISA KEV added 2026-05-26 Exploited in the wild PoC

    LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash....

  6. CVE-2021-47903 LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

    Published
    HighCVSS 8.6 EPSS 1.6%

    LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code e...

  7. CVE-2021-47855 Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

    Published
    MediumCVSS 5.1 EPSS 0.28%

    Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrat...

  20. CVE-2022-0072 Directory Traversal in OpenLiteSpeed Web Server

    Published
    MediumCVSS 5.8 EPSS 1.1%

    Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1

  21. CVE-2007-5654 LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source c...

    Published
    MediumCVSS 5.0 EPSS 41.1%

    LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.