EUVD-2026-124650

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit th...

EUVD-2026-124637

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system"/usr/bin/lua "+argv on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv...

CVE-2026-124008

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit th...

CVE-2026-124003

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system"/usr/bin/lua "+argv on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv...

CVE-2026-124008 Dixell/Copeland XWEB EVO OS Command Injection via devices.lua

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit th...

CVE-2026-124008

XWEB EVO versions 5.2.3 through 5.8.8 are vulnerable to an authenticated OS command injection flaw within the devices.lua template handling. The root cause is the injection of unescaped template source into unzip and related shell commands, which can be exploited via the wlua interpreter . Succes...

CVE-2026-124003 Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system"/usr/bin/lua "+argv on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv...

CVE-2026-124003

The XWEB EVO software (versions before 5.6.2 ) is susceptible to a command injection vulnerability in the setuid-root Lua CGI interpreter (wlua ). The root cause is the execution of system("/usr/bin/lua " + argv) using unsanitized input. An attacker can provide malicious input via a .lua CGI endp...