Вернуться к предупреждениям о безопасности

LiteSpeed CVE-2026-93903

CVE-2026-93903 is a vulnerability in LiteSpeed Web Server builds before 6.3.7 build 1, where internal redirect URL validation is mishandled in a certain corner case. NVD rates it Critical with a CVSS 3.1 base score of 9.4. Anyone running an affected LiteSpeed Web Server build should update to 6.3.7 build 1 or later.

Critical 9.4 CVSS
LiteSpeed

Что это значит по лицензии SharedLicense

Because redirect URL validation fails in an edge case, an attacker may be able to reach internal targets through crafted requests; the full exploitability window is described only as a corner case by NVD.

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain “corner case.”

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-93903

Часто задаваемые вопросы

What is CVE-2026-93903?
It is the CVE ID for a flaw in LiteSpeed Web Server before 6.3.7 build 1 that mishandles internal redirect URL validation in a certain corner case. NVD assigns it CWE-174 (Interpretation Conflict) and a CVSS base score of 9.4.
Which LiteSpeed versions are affected?
LiteSpeed Web Server builds before 6.3.7 build 1 are affected. Builds at 6.3.7 build 1 or later contain the fix — this matches the DirectAdmin forum's separate advice that Enterprise 6.3.7 or later is required.
How do I fix CVE-2026-93903?
Update LiteSpeed Web Server Enterprise to 6.3.7 build 1 or later through your normal LiteSpeed update channel (or the WHM LiteSpeed plugin if installed), then confirm the running build in the LiteSpeed Web Admin console.
Is CVE-2026-93903 being exploited in the wild?
No confirmed exploitation has been announced, and NVD has not recorded exploit intelligence for this CVE yet. Given the critical rating, patch on a priority basis rather than waiting.

Источники

Предупреждения о безопасности

Похожие предупреждения

LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

2026-09-19

Security Advisory: LiteSpeed Web Server Enterprise 6.3.7 or later is required

2026-09-18

Security: LiteSpeed Enterprise security advisory – September 14, 2026

2026-09-14

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему