CVE-2026-93903

CVSS 9.4 (critical) · published 2026-09-30

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

Weakness: CWE-174

Source: NVD CVE-2026-93903

References

• https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1
• https://github.com/Tautvydas-Aleliunas/CVE-2026-93903
• https://lnkd.in/p/d2HZDcUC
• https://www.litespeedtech.com/products/litespeed-web-server/release-log

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.