PT-2026-4516 · Litespeed Technologies · Litespeed Web Server Enterprise

Published 2026-01-23 · Updated 2026-01-24 · CVE-2021-47903

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server Enterprise version 5.4.11

Description LiteSpeed Web Server Enterprise version 5.4.11 has an issue where a user with administrative privileges can inject commands into the system. This occurs through the 'Command' parameter within the server configuration interface, potentially leading to remote code execution. The issue involves path traversal and bash command injection. The vulnerable parameter is Command.

Recommendations Apply any available configuration updates to address the command injection issue in the external app configuration interface.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-47903

Affected Products

Litespeed Web Server Enterprise

References · 7

• 🔥 https://exploit-db.com/exploits/49523 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47903 · Security Note
• https://twitter.com/CVEnew/status/2014995830940537191 · Twitter Post
• https://litespeedtech.com/products · Note
• https://litespeedtech.com · Note
• https://t.me/CVEtracker/42864 · Telegram Post
• https://vulncheck.com/advisories/litespeed-web-server-enterprise-command-injection · Note