The flaw is a CWE‑174 input validation weakness. In LiteSpeed Web Server versions prior to 6.3.7 build 1, the server incorrectly handles internal redirect URL validation in a specific corner case involving double decoding of %252e%252e. This allows a low‑privileged tenant to construct a request that forces an internal redirect, causing the server to execute code in the context of a different account. The result is that the attacker can run arbitrary code or manipulate data under another user’s privileges, compromising confidentiality, integrity, and potential availability of that other account.

The issue affects LiteSpeed Web Server versions earlier than 6.3.7 build 1 on systems running the LiteSpeed Web Server product from LiteSpeed Tech.

With a CVSS score of 9.4 this flaw is considered high severity. EPSS is <1% and it is not in KEV. The vulnerability can be triggered by a crafted HTTP request that forces an internal redirect in the double‑decoding corner case, enabling a low‑privileged tenant to execute code under another account. Its impact includes potential for arbitrary code execution and privilege escalation. The attack surface is effectively remote, as the exploit requires only an external request, but the lack of an immediate exploit and low EPSS indicate that the risk is high when the server is exposed publicly.