CVE-2026-104474 — OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as roo…
Published: 2026-10-02 · CVSS: 5.4 · CVSS 4.0
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7