5.8Medium

CVE-2022-0072Directory Traversal in OpenLiteSpeed Web Server

LiteSpeed Technologies OpenLiteSpeed Web Server; LiteSpeed Technologies LiteSpeed Web Server Published: 2022-10-27 22:28 (4 years ago)

Description

Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
LiteSpeed Technologies	LiteSpeed Web Server	1.5.11 – ≤ 1.5.12, 1.6.5 – ≤ 1.6.20.1, 1.7.0 – < 1.7.16.1
LiteSpeed Technologies	OpenLiteSpeed Web Server	1.5.11 – ≤ 1.5.12, 1.6.5 – ≤ 1.6.20.1, 1.7.0 – < 1.7.16.1

References and patches

CVSS score

5.8Medium

Source: palo_alto · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS (chance of exploitation in 30 days)

1.14%

higher than 67% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2021-12-28
Published2022-10-27 22:28
Reached IP-DB2026-10-24 23:38
Last updated2025-05-09 22:18

Assigned by (CNA): palo_alto

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — LiteSpeed / OpenLiteSpeed

5.9Medium

CVE-2026-119559 12 days ago

OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

litespeedtech openlitespeed

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that alway…

6.7Medium

CVE-2026-104474 1 month ago

OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update

litespeedtech openlitespeed

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/lo…

9.4Critical

CVE-2026-93903 1 month ago

litespeedtech LiteSpeed Web Server

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

7.2High

CVE-2026-31386 8 months ago

LiteSpeed Technologies OpenLiteSpeed; LiteSpeed Technologies LSWS Enterprise

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

1.5%EPSS

8.8High

CVE-2021-47903 9 months ago

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

LiteSpeed Technologies Inc LiteSpeed Web Server Enterprise

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, a…

1.6%EPSS

7.2High

CVE-2021-47855 9 months ago

Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

LiteSpeed Technologies OpenLiteSpeed

Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execut…