CVE-2026-93903: LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case"

Description

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

References

• https://lnkd.in/p/d2HZDcUC(third-party-advisory)
• https://www.litespeedtech.com/products/litespeed-web-server/release-log
• https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1
• https://github.com/Tautvydas-Aleliunas/CVE-2026-93903

Related News (1 articles)

Discussion (0)

Loading…