CVE-2026-104474
Received Received - Intake

Local Privilege Escalation in OpenLiteSpeed via Malicious Update Package

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-104474
EUVD
EUVD-2026-91850

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
litespeedtech openlitespeed to 1.9.3 (exc)
litespeedtech openlitespeed to 1.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenLiteSpeed before version 1.9.3 has a local privilege escalation vulnerability in the lsup.sh update script. The script runs unverified update packages from a directory writable by the nobody user as root. Attackers controlling the nobody web process can replace the update package before extraction, causing malicious code to execute with root privileges during the next update.

Detection Guidance

Check if OpenLiteSpeed version is below 1.9.3 using command: openlitespeed -v or check package version via your system's package manager. Inspect the lsup.sh script in /usr/local/lsws/admin/misc/ for write permissions to the nobody user. Monitor /usr/local/lsws/autoupdate/ directory for unexpected files or modifications.

Impact Analysis

An attacker with local access and low privileges could escalate to root access by exploiting this vulnerability. This could lead to full system compromise, unauthorized data access, or installation of persistent malware. The attack requires local access but no special privileges beyond controlling the nobody web process.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade OpenLiteSpeed to version 1.9.3 or later immediately. Remove write permissions for the nobody user from /usr/local/lsws/autoupdate/. Verify the integrity of the lsup.sh script and ensure no unauthorized modifications exist. Restrict access to the update directory and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart