---
id: "CVE-2026-124007"
page: "https://infrastack.ai/live/CVE-2026-124007"
kind: "vulnerability"
aliases: ["CVE-2026-124007"]
title: "XWEB EVO: unauthenticated password field lets attackers run root commands"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "self-hosted", "xweb-evo"]
not_affected_if: ["xweb-evo-5.6.2-or-later"]
published_at: "2026-11-12T20:18:23+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:41:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124007", "first_seen_at": "2026-11-12T20:40:25+00:00"}]
exploit_sources: []
---

# XWEB EVO: unauthenticated password field lets attackers run root commands

Link for people: https://infrastack.ai/live/CVE-2026-124007 (this .md is for agents)

XWEB EVO before 5.6.2 passes the login password unescaped into a shell command in login.lua, cleanout.lua and api.lua. An unauthenticated remote attacker who injects shell metacharacters into the password field can execute arbitrary commands, with root-level access via the setuid wlua interpreter.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether any XWEB EVO installation runs a version earlier than `5.6.2`
- Confirm whether the login page or API is reachable from untrusted networks

## Fix

- XWEB EVO: move to `5.6.2` or later
- The product line reached end of service in March 2026, so a fixed release may not be available for every installation

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124007

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-auth-os-command-injection-via-password-field

## From the sources

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_