Security Advisory

CVE-2026-104474

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-10-02 23:28:45

Last updated 2026-10-05 14:50:08

Assigner VulnCheck

CVSS score 6.7

State PUBLISHED

Description

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

← Browse all CVEs View on cve.org ↗