CVE-2026-104474

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104474
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104474.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104474
Published
2026-10-02T23:28:45Z
Modified
2026-10-04T07:03:19Z
Severity
  • 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update
Details

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-367"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104474.json"
}
References

Affected packages

Git / github.com/litespeedtech/openlitespeed

Affected ranges

Type
GIT
Repo
https://github.com/litespeedtech/openlitespeed
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bf584c1b7cd6edd5dacfffaad477bcb67d65d732
Fixed
468523ce84388cea9ba6633c26517bc05b3e2bc1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.9.3"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other
broken_modsec
v1.*
v1.0.4
v1.3
v1.3.2
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.0rc6
v1.5.2
v1.6.3
v1.7.0
v1.7.1
v1.7.10
v1.7.10.1
v1.7.10.2
v1.7.17
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.7.9.1
v1.7.9.2
v1.8.0
v1.8.1
v1.9.0
v1.9.0.1
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104474.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2125362203580197755792326805685250372",
            "length":  1971
        },
        "id":  "CVE-2026-104474-3ea6d0b9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/litespeedtech/openlitespeed/commit/bf584c1b7cd6edd5dacfffaad477bcb67d65d732",
        "target":  {
            "file":  "src/http/requestvars.cpp",
            "function":  "RequestVars::setEnv"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "322848671198276622123071718230853437515",
                "137521964143416189227387714904764673259",
                "37555269937062941136775005567498507725",
                "53079506554068539713271537603646810771"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-104474-689ec833",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/litespeedtech/openlitespeed/commit/bf584c1b7cd6edd5dacfffaad477bcb67d65d732",
        "target":  {
            "file":  "src/http/requestvars.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-10-04T07:03:19Z"