CVE-2026-124003 · Infrastructure
NO FIX YET · SEE WHAT TO DO
XWEB EVO before 5.6.2 has a setuid-root Lua CGI interpreter, wlua, that passes unsanitized request input into a system() call. An attacker who reaches a .lua CGI endpoint can inject shell commands and run them with root privileges.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any XWEB EVO deployment before 5.6.2 that exposes its web interface with CGI Lua endpoints is exposed to the injection. Deployments not running XWEB EVO, or with the CGI endpoints unreachable, can skip it. The product line is past end of service, so the vendor may not ship a fix for supported installs.
Not affected if cgi-endpoints-unreachable, not-xweb-evo
Who cares cgi, lua, setuid, xweb-evo
5.6.2.wlua binary with the setuid bit set and reachable .lua CGI endpoints on the web interface.5.6.2 or later, according to the NVD range data.XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.