CVE-2007-5654: LiteSpeed Technologies LiteSpeed Web Server

Medium severity, CVSS 5.0. EPSS: 41.1% chance of exploitation in the next 30 days.

LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."

Affected products

• LiteSpeed Technologies LiteSpeed Web Server: up to and including 3.2.3

Published 2007-10-23. Last modified 2026-06-16.