CVE-2026-31386
- State
- Published
- Severity
- 8.6 High
- Published
- Mar 16, 2026
- Updated
- Mar 16, 2026
- Reserved
- Mar 9, 2026
Description
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | jpcert |
| 3.0 | 7.2 High | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | jpcert |
Weaknesses
- CWE-78 Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
OpenLiteSpeedLiteSpeed Technologies |
|
LSWS EnterpriseLiteSpeed Technologies |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.