CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

State: Published
Severity: 8.6 High
Published: Jan 23, 2026
Updated: Jul 15, 2026
Reserved: Jan 18, 2026

Description

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
LiteSpeed Web Server EnterpriseLiteSpeed Technologies Inc	5.4.11Affected

References

ExploitDB-49523exploit
LiteSpeed Technologies Official Homepageproduct
LiteSpeed Web Server Product Pageproduct
VulnCheck Advisory: LiteSpeed Web Server Enterprise 5.4.11 - Command Injectionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.