CVE-2026-104474 in OpenLiteSpeed
Summary
by MITRE • 10/03/2026
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in OpenLiteSpeed versions prior to 1.9.3 represents a critical local privilege escalation flaw rooted in insecure file handling practices within the administrative maintenance scripts. Specifically, the script located at admin/misc/lsup.sh is responsible for managing software updates but fails to implement adequate integrity verification or access controls when processing update packages. The core technical deficiency lies in the use of /usr/local/lsws/autoupdate/ as a staging directory that remains writable by the nobody user account. This configuration creates a classic race condition and insecure temporary file scenario where any process running under the low-privilege nobody identity can manipulate files destined for execution with elevated privileges.
From an operational perspective, this flaw allows an attacker who has gained control over the web server process or any other service operating as the nobody user to escalate their access rights significantly. By placing a maliciously crafted update package into the writable autoupdate directory before the scheduled update routine executes, the attacker ensures that their code is extracted and executed during the next maintenance cycle. Since the lsup.sh script runs with root privileges to perform system-level updates, it inadvertently grants full administrative control over the host machine to the attacker through the execution of a malicious install.sh script contained within the tampered package. This bypasses standard security boundaries and effectively compromises the entire server infrastructure.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-250, which describes execution with unnecessary privileges, and CWE-379, concerning creation of a temporary file in a directory accessible to other users. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is indicative of techniques related to privilege escalation via insecure permissions or path traversal vulnerabilities that allow unauthorized modification of system components. The attack vector relies on the attacker's ability to write to specific directories and exploit the trust relationship between a low-privilege process and a high-privilege administrative script.
To mitigate this risk, immediate action is required by upgrading OpenLiteSpeed to version 1.9.3 or later where these permission checks have been addressed. Administrators should also audit their server configurations to ensure that directories used for temporary file storage or update staging are not world-writable and are owned by the appropriate service account with restrictive permissions. Implementing strict access control lists and ensuring that scripts performing privileged operations validate the integrity of input files before execution can further reduce the attack surface against similar local privilege escalation attempts.