CVE-2021-47903
Published: 23 January 2026
Summary
CVE-2021-47903 is a high-severity OS Command Injection (CWE-78) vulnerability in Litespeedtech (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
LiteSpeed Web Server Enterprise version 5.4.11 suffers from an authenticated command injection vulnerability in its external app configuration interface. The flaw allows attackers to inject shell commands through the 'Command' parameter within the server configuration, facilitating remote code execution via path traversal and bash command injection. This issue is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated administrators with access to the configuration interface can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Exploitation enables the execution of arbitrary shell commands on the affected server, granting high-impact control over confidentiality, integrity, and availability, potentially leading to full system compromise.
Advisories and resources include a proof-of-concept exploit published on Exploit-DB (ID 49523) and a detailed advisory from Vulncheck on the LiteSpeed Web Server Enterprise command injection vulnerability. References to LiteSpeed Technologies' official website and products page are available, though specific patch or mitigation guidance is not detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4277
Vulnerability details
LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash…
more
command injection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2021-47903 is a command injection vulnerability in a public-facing web server configuration interface (T1190: Exploit Public-Facing Application), enabling remote code execution via bash shell commands (T1059.004: Unix Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires input validation and error handling for the 'Command' parameter in the external app configuration interface to neutralize special elements used in OS commands, preventing injection.
Mandates timely identification, reporting, and correction of the specific command injection flaw (CVE-2021-47903) in LiteSpeed Web Server.
Restricts and manages access to configuration changes, limiting authenticated administrators' ability to reach and exploit the vulnerable external app configuration interface.