CVE-2026-124013

HIGH

MEDIUM Priority: 0.24 BB Relevance: 68/100

Published: 2026-11-12 Modified: 2026-11-13 First seen: 2026-11-12 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: Low

UI: None

AT: None

VC: High

VI: High

VA: High

Description

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.