Vulnerability in Litespeedtech Openlitespeed
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
Published .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- openlitespeed.org/release-log/version-1-9-x/ (vendor-advisory)
- github.com/litespeedtech/openlitespeed/commit/468523ce84388cea9ba6633c26517bc05… (patch)
- github.com/litespeedtech/openlitespeed/blob/v1.9.2/dist/admin/misc/lsup.sh (technical-description)
- www.vulncheck.com/advisories/openlitespeed-before-1.9.3-local-privilege-escalat… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-104474?
- CVE-2026-104474 is a medium-severity vulnerability in Litespeedtech Openlitespeed, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 6.7/10. Published 2026-10-03.
- How severe is CVE-2026-104474?
- Medium severity. CVSS v3 base score is 6.7 out of 10.