CVE-2026-124013: Dixell/Copeland XWEB EVO OS Command Injection via api.lua
XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua importpreconfiguration and restore actions, where serverurl and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs authenticated access with at least low privileges. No user interaction is required, and the vulnerable API is reachable over the network.
What level of access can successful exploitation provide?
Injected commands are executed through a root curl command, allowing arbitrary command execution with root privileges on the underlying system.
Which inputs and actions are affected?
The affected api.lua import_preconfiguration and restore actions concatenate server_url and related server credential fields into a shell command without escaping.
What should organizations do if they cannot patch?
The provided information does not identify a workaround. Since the product line reached end of service in March 2026, restrict authenticated network access to the affected interface and plan to replace or otherwise retire affected systems.