Description

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

Remediation

References

CVE-2026-31386

Related Vulnerabilities

Django Improper Validation of Specified Quantity in Input Vulnerability (CVE-2023-43665)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-30599)

Oracle Application Server CVE-2007-5521 Vulnerability (CVE-2007-5521)

PostgreSQL Integer Overflow or Wraparound Vulnerability (CVE-2026-6473)

WordPress Plugin Essential Real Estate Cross-Site Scripting (1.7.0)

Severity

High

Classification

CVE-2026-31386 CWE-138 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities