EUVD-2026-124651

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped...

CVE-2026-124009

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped...

CVE-2026-124009 Dixell/Copeland XWEB EVO OS Command Injection via backup.lua

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped...

CVE-2026-124009

The XWEB EVO product (versions 5.2.3 through 5.8.8 ) is vulnerable to an authenticated OS command injection vulnerability. The root cause is the unescaped concatenation of shell metacharacters into the output device path parameter processed by backup.lua. Attackers with authentication can exploit...