CVE-2026-124009

Name of the Vulnerable Software and Affected Versions XWEB EVO versions 5.2.3 through 5.8.8

Description An authenticated OS command injection flaw exists where attackers can execute arbitrary commands with root privileges. This occurs by injecting shell metacharacters into the output device path parameter processed by backup.lua. The issue stems from unescaped concatenation into mount, unzip, and related shell commands executed via the wlua interpreter, specifically through the setuid xwbackup.cgi and xwrestore.cgi interfaces, potentially leading to full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.