What is CVE-2021-47903?

CVE-2021-47903 is a high-severity vulnerability in Litespeed Technologies Inc Web Server Enterprise, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-01-23.

How severe is CVE-2021-47903?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Litespeed Technologies Inc Web Server Enterprise

CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.014 (70.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Litespeed Technologies Inc Web Server Enterprise — versions 5.4.11

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

ExploitDB-49523 (exploit)
LiteSpeed Technologies Official Homepage (product)
LiteSpeed Web Server Product Page (product)
VulnCheck Advisory: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection (third-party-advisory)

Frequently asked questions

What is CVE-2021-47903?: CVE-2021-47903 is a high-severity vulnerability in Litespeed Technologies Inc Web Server Enterprise, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-01-23.
How severe is CVE-2021-47903?: High severity. CVSS v3 base score is 8.8 out of 10.