LiteSpeed Web Server Enterprise 5.4.11 - Command Injection | Advisories

Advisories

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

severity: high
date: January 22, 2026
Affecting: LiteSpeed Web Server Enterprise 5.4.11
CVE: CVE-2021-47903
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-49523
LiteSpeed Technologies Official Homepage
LiteSpeed Web Server Product Page
Credit: cmOs - SunCSR
Description: LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.