{"affected":[{"defaultStatus":"unaffected","product":"LiteSpeed Web Server","source":"CNA: mitre","vendor":"litespeedtech","versions":[{"lessThan":"6.3.7 build 1","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-93903","cwes":["CWE-174"],"description":"LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain \"corner case\" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.","epss":{"date":"2026-11-04","percentile":0.20982,"score":0.00283},"exploits":[],"kev":null,"metrics":[{"score":9.4,"severity":"critical","source":"CNA: mitre","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"}],"modifiedAt":1793848500542,"publishedAt":1790775851915,"references":[{"source":"CNA: mitre","tags":["third-party-advisory"],"url":"https://lnkd.in/p/d2HZDcUC"},{"source":"CNA: mitre","tags":[],"url":"https://www.litespeedtech.com/products/litespeed-web-server/release-log"},{"source":"CNA: mitre","tags":[],"url":"https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/Tautvydas-Aleliunas/CVE-2026-93903"}],"remediation":[],"revision":"7fa989b022a59c2632b021c8f64226e8c0fd8dc8069ae08c112e0cd34b5ecf72","sources":[{"modifiedAt":1793848500542,"name":"CNA: mitre","retrievedAt":1793851731068,"url":"https://www.cve.org/CVERecord?id=CVE-2026-93903"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793851734737,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93903"}],"ssvc":{"assessedAt":1790785820403,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-93903","updatedAt":1793851734737}