RCE in Litespeed Technologies Inc Web Server Enterprise
CVE-2021-47903
LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (75.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.016 · change: +0.002
Affected products
- Litespeed Technologies Inc Web Server Enterprise — versions 5.4.11
Weakness classification (CWE)
References
- ExploitDB-49523 (exploit)
- LiteSpeed Technologies Official Homepage (product)
- LiteSpeed Web Server Product Page (product)
- VulnCheck Advisory: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection (third-party-advisory)
Frequently asked questions
- What is CVE-2021-47903?
- CVE-2021-47903 is a high-severity vulnerability in Litespeed Technologies Inc Web Server Enterprise, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-01-23.
- How severe is CVE-2021-47903?
- High severity. CVSS v3 base score is 8.8 out of 10.