Description
LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
LiteSpeed Source Code Disclosure/Download
auxiliary/scanner/http/litespeed_source_disclosure
Exploit-DB 1
- Litespeed Technologies - Web Server Remote Poison Null Byte EDB-13850 · remote · Jun 13, 2010 · verified
GitHub 1 repository
-
jmonge12/Home-Network-Vulnerability-Assessment ★ 0 · May 30, 2026
Auditoría de seguridad y análisis de vulnerabilidades (CVE-2014-3566 y CVE-2010-2333) en la infraestructura de red local y router residencial.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 13850 exploit
- http://www.litespeedtech.com/latest/litespeed-web-server-4.0.15-released.html
- 65476 vdb-entry
- 40128 third-party-advisory
- http://www.litespeedtech.com/support/forum/showthread.php?t=4078
- 20100613 Litespeed Technologies Web Server Remote Poison null byte Zero-Day mailing-list
- 40815 vdb-entry