CVE-2026-124002 · Other
NO FIX YET · SEE WHAT TO DO
XWEB EVO versions 5.2.3 through before 5.7.0 pass the username field into operating system commands before the password check, so shell metacharacters run on the server. Because the setuid-root wlua interpreter is reachable, an attacker can gain root and fully compromise the system.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any organization running XWEB EVO 5.2.3 up to 5.7.0 with the web interface reachable from the network is exposed, since the flaw needs no login. Systems that do not run XWEB EVO, or where the management interface is not reachable from untrusted networks, are not affected. The product has reached end of service, so the sources give no support path beyond upgrading.
Not affected if no-external-access, not-xweb-evo
Who cares network-appliance, self-hosted, xweb-evo
5.2.3 up to before 5.7.0 are in rangelogin.lua, cleanout.lua, or api.lua with shell metacharacters in the username field in web server logs5.7.0 or later (the product data gives this as the fixed version)XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.