Vulnerability · Published Jan 23, 2026 · Assigned by VulnCheck
CVE-2021-47903LiteSpeed Web Server Enterprise 5.4.11 - Command Injection
High 8.8
In plain English
A high-severity OS command injection in LiteSpeed Web Server Enterprise from LiteSpeed Technologies Inc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 23.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LiteSpeed Technologies Inc | LiteSpeed Web Server Enterprise | 5.4.11 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49523 exploit
- LiteSpeed Technologies Official Homepage product
- LiteSpeed Web Server Product Page product
- VulnCheck Advisory: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection third-party-advisory