{"id":"CVE-2026-104474","aliases":["EUVD-2026-91850","GHSA-4qqw-wg6j-834r"],"status":"published","title":"OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update","description":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00085,"percentile":0.00264,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-367"],"published":"2026-10-02T23:28:45Z","modified":"2026-11-08T10:45:21Z","products":[{"vendor":"litespeed technologies","product":"openlitespeed"},{"vendor":"litespeedtech","product":"openlitespeed"}],"references":[{"url":"https://openlitespeed.org/release-log/version-1-9-x/","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/litespeedtech/openlitespeed/commit/468523ce84388cea9ba6633c26517bc05b3e2bc1","tags":["patch","fix"]},{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.9.2/dist/admin/misc/lsup.sh#L538","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/openlitespeed-before-1.9.3-local-privilege-escalation-via-lsup-sh-auto-update","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104474","tags":["advisory"]},{"url":"https://openlitespeed.org/release-log/version-1-9-x"},{"url":"https://github.com/advisories/GHSA-4qqw-wg6j-834r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104474.json","tags":["advisory"]},{"url":"https://github.com/litespeedtech/openlitespeed","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-104474","title":"OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update","description":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.","status":"published","published":"2026-10-02T23:28:45.481Z","modified":"2026-10-05T14:50:08.677Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-91850","description":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.","status":"published","published":"2026-10-02T23:28:45Z","modified":"2026-10-05T14:50:08Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:40.198021Z"}],"ghsa":[{"id":"GHSA-4qqw-wg6j-834r","title":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup...","description":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.","status":"published","published":"2026-10-03T00:31:14Z","modified":"2026-10-03T00:31:14Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:12:44.258575Z"}],"nvd":[{"id":"CVE-2026-104474","description":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.","status":"published","published":"2026-10-03T00:16:35.413Z","modified":"2026-10-06T16:08:43.18Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-104474","title":"OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update","description":"OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.","status":"published","published":"2026-10-02T23:28:45.481Z","modified":"2026-11-08T13:15:04.345571234Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-08T11:04:08.386699Z"}]}}