Published:2026/03/16 Last Updated:2026/03/16
JVN#22152812
OpenLiteSpeed and LSWS Enterprise vulnerable to OS command injection
Overview
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.
Products Affected
- OpenLiteSpeed all versions
- LSWS Enterprise all versions
Description
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain the following vulnerability.
- OS command injection (CWE-78)
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
- CVE-2026-31386
Impact
An arbitrary OS command may be executed by an attacker with the administrative privilege.
Solution
Apply the Workaround
The developer recommends users apply the following workaround.
- Restrict access to the port used by the WebAdmin console and/or allow connections only from trusted IP addresses.
Vendor Status
| Vendor | Link |
| LiteSpeed Technologies Inc. | OpenLiteSpeed |
| LiteSpeed Web Server |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Credit
Daisuke Nakayama of Mizuho Financial Group, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2026-31386 |
| JVN iPedia |
JVNDB-2026-000037 |