CVE-2026-124007

Name of the Vulnerable Software and Affected Versions XWEB EVO versions prior to 5.6.2

Description A pre-authentication OS command injection flaw allows unauthenticated remote attackers to execute arbitrary commands with root-level privileges. The issue occurs due to the unescaped interpolation of the password value into the hashpass invocation within the login.lua, cleanout.lua, and api.lua files, which is then executed via the setuid wlua interpreter. Attackers can trigger this by injecting shell metacharacters into the password field.

Recommendations Update XWEB EVO to version 5.6.2 or later.