CVE-2026-124003: Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.
Event History
Frequently Asked Questions
Which deployments are affected?
XWEB EVO versions before 5.6.2 are affected. The issue is in Lua CGI endpoints handled by the setuid-root wlua interpreter.
What level of access does an attacker need?
The CVSS vector indicates local attack vector and low privileges required, with no user interaction. Exploitation requires reaching a .lua CGI endpoint with malicious input.
What is the impact of successful exploitation?
An attacker can inject arbitrary commands into the Lua interpreter invocation and execute them with root privileges. This can compromise confidentiality, integrity, and availability.
What should be done if the affected product cannot be upgraded?
The provided information identifies XWEB EVO as end of service as of March 2026, but does not specify an alternative mitigation. Prioritize restricting access to .lua CGI endpoints and the affected system to authorized users while planning replacement or migration.