CVE-2026-124003
HIGH
NVD
CVSS Score
7.8
Severity
HIGH
Published
Nov 12, 2026
Vendor
unknown
Description
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.