LiteSpeed has released LiteSpeed Web Server Enterprise 6.3.7 build 2, the second
follow-up build in its response to a critical privilege-escalation flaw in the lscgid
CGI helper. A malicious website user on a shared-hosting server could potentially bypass
account isolation, including CloudLinux CageFS, and gain root-level access to the server.
The version number alone is no longer enough. If you installed 6.3.7 when it first shipped, or updated again to build 1, the server is still affected according to LiteSpeed's latest advisory. The required baseline is now 6.3.7 build 2 or later.
Who needs to update
The advisory applies to LiteSpeed Web Server Enterprise installations not running 6.3.7 build 2 or later. It is especially urgent on shared cPanel, Plesk, and DirectAdmin servers where customers can run CGI applications or otherwise control website content.
The patch sequence has moved quickly:
| Release | Security change | Current status |
|---|---|---|
| 6.3.7 build 0 | Strengthened lscgid request authentication, internal redirect validation, and protection of internal environment variables | Superseded |
| 6.3.7 build 1 | Addressed another corner case in internal redirect URL validation | Superseded |
| 6.3.7 build 2 | Further hardens the lscgid CGI helper | Current minimum |
LiteSpeed has not assigned a public CVE identifier in the advisory. The vendor describes the original issue as critical because a low-privilege website user could potentially escape expected account isolation and reach root privileges. The advisory does not state that exploitation has been observed in the wild.
Check the installed version and build
Run both commands as root:
/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/BUILD
The first command identifies the installed LSWS version. The second is the decisive check for this update: it must report 2 or a later build for version 6.3.7.
For a small fleet, you can check each server over SSH:
for h in $(cat servers.txt); do
printf '%s: ' "$h"
ssh -n "root@$h" '/usr/local/lsws/bin/lshttpd -v 2>&1; printf "build "; cat /usr/local/lsws/BUILD'
done
Install 6.3.7 build 2
LiteSpeed's advisory supplies this forced update command:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
After it completes, restart LiteSpeed:
/usr/local/lsws/bin/lswsctrl restart
Then verify the build again rather than assuming the updater selected the newest package:
/usr/local/lsws/bin/lshttpd -v
cat /usr/local/lsws/BUILD
If the build still reports 0 or 1, do not treat the host as patched. LiteSpeed notes
that newly announced builds can take time to reach every update channel; retry once the
package is available or contact LiteSpeed support rather than downgrading to an earlier
release.
The update is for LSWS Enterprise itself, not the LiteSpeed Cache WordPress plugin. Updating LSCWP does not replace this server-level patch. If you are still deploying LSWS across a fleet, see installing LiteSpeed on cPanel and installing LiteSpeed on Plesk for the control-panel integration paths.
What to verify after the restart
LiteSpeed recommends confirming normal operation of CGI applications and server-level logging tools after the update. Check at least:
- a representative CGI application on each server;
- sites or services that write through piped loggers;
- the LSWS error log at
/usr/local/lsws/logs/error.logfor new startup or permission errors; - the WebAdmin or control-panel plugin to confirm LSWS returned to service.
A basic service check is:
/usr/local/lsws/bin/lswsctrl status
curl -I https://yourdomain.example/
Review servers that were exposed
Patching closes the known path but does not undo activity that happened before the update. LiteSpeed advises reviewing affected hosts for unusual CGI activity or piped logging behaviour. Prioritise servers with untrusted shared-hosting accounts and inspect logs from the period before build 2 was installed.
Look for unexplained CGI execution, unexpected changes to root-owned files, unfamiliar scheduled tasks, or logging helpers that no longer match your configuration. These are general compromise-review checks, not indicators LiteSpeed has attributed specifically to this flaw. If you find evidence of root-level modification, isolate the host and follow your incident-response process rather than relying on the update alone.
Sources
- LiteSpeed Web Server release log
- LiteSpeed Web Server changelog
- LiteSpeed Technologies security advisory emailed 17 September 2026: “Additional LiteSpeed Enterprise security update”