High severity · published Apr 7, 2021
CVE-2021-26758
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system
8.8
CVSS
2.7%
EPSS
No
On KEV
Description
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openlitespeed · Litespeedtech
1.7.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26758
Exploit
https://docs.unsafe-inline.com/0day/openlitespeed-web-server-1.7.8-command-injection-to-privilege-escalation-cve-2021-26758
Exploit
https://github.com/litespeedtech/openlitespeed/issues/217
Exploit
https://www.exploit-db.com/exploits/49556
More from Openlitespeed
9.8
CVE-2020-5519
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen
8.8
CVE-2022-0074
Privilege Escalation in OpenLiteSpeed Web Server
8.8
CVE-2022-0073
Authenticated Remote Code Execution in OpenLiteSpeed Web Server
7.5
CVE-2025-54939
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak
7.5
CVE-2023-40518
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers