LiteSpeed Technologies LiteSpeed Cache versions up to 6.4.1 contain a Relative Path Traversal vulnerability (CVE-2024-47637) that allows an attacker with low privileges to manipulate file paths to access files outside the intended directory. This can lead to unauthorized disclosure, modification, or deletion of files, impacting confidentiality, integrity, and availability. The vulnerability is remotely exploitable without user interaction and has a high CVSS score of 8.8. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow an attacker to read, modify, or delete files outside the web root or intended directories, potentially leading to data compromise, service disruption, or further system compromise. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the LiteSpeed Cache plugin, limit privileges of users who can interact with it, and monitor for suspicious activity related to file access. Avoid exposing the affected versions to untrusted networks if possible.