CVE-2026-93903

UNKNOWN

Description

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

Timeline

Published:September 30th, 2026 2:17 PM

Last modified:November 5th, 2026 4:17 AM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-174

References & Reports

Advisories, patches, and third-party reports

https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1
https://github.com/Tautvydas-Aleliunas/CVE-2026-93903
https://lnkd.in/p/d2HZDcUC
https://www.litespeedtech.com/products/litespeed-web-server/release-log

Source: NIST NVD · Data may lag official sources by up to one minute