CVE-2026-124013

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua importpreconfiguration and restore actions, where serverurl and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject...