CVE-2026-124014

Name of the Vulnerable Software and Affected Versions XWEB EVO versions 4.3.0 through 5.8.8

Description An unauthenticated arbitrary file write issue allows remote attackers to modify the system configuration file /etc/xwebconfig.json. This is achieved by sending a crafted POST request to the config.lua endpoint with the action parameter set to set. The system fails to perform session validation and writes the raw, unvalidated request body to the file. Attackers can manipulate configuration values, such as the model and plugin fields, or trigger a SYSTEM NOT CONFIGURED state using the action=get and action=set operations, leading to configuration tampering and denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.