CVE-2026-31386
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
- Score
- CVSS 4.0 8.6 High
- Status
- Analyzed - vultures@jpcert.or.jp
- Published
- 2026-03-16
- Last modified
- 2026-03-16
- Weaknesses
- CWE-78
Affected products
- Lsws Enterprise (Litespeed Technologies)
- Openlitespeed (Litespeed Technologies)
- Litespeed Web Server (Litespeedtech)
- Openlitespeed (Litespeedtech)
References
- https://jvn.jp/en/jp/JVN22152812/
- https://openlitespeed.org/
- https://www.litespeedtech.com/products/litespeed-web-server
