CVE-2026-124009: Dixell/Copeland XWEB EVO OS Command Injection via backup.lua
XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise.
Event History
Frequently Asked Questions
Which XWEB EVO versions are affected?
XWEB EVO versions 5.2.3 through 5.8.8 are affected.
What access does an attacker need to exploit this issue?
An attacker must be authenticated. The attack can be performed remotely over the network and does not require user interaction.
What level of access can successful exploitation provide?
Successful exploitation allows arbitrary command execution as root, resulting in full compromise of system confidentiality, integrity, and availability.
Which interfaces are involved in exploitation?
The vulnerable output device path is processed by backup.lua. The setuid xwbackup.cgi and xwrestore.cgi interfaces can also be used to reach the vulnerable command execution path.