Command Injection Vulnerability in XWEB EVO by Dixell/Copeland
CVE-2026-124003

8.5HIGH

Key Information:

Vendor

Copeland

Status
Xweb Evo
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124003?

XWEB EVO before version 5.6.2 is susceptible to a command injection flaw due to the execution of unsanitized input within its setuid-root Lua CGI interpreter. This vulnerability allows attackers to manipulate inputs through a .lua CGI endpoint, enabling them to inject arbitrary commands in the execution context, potentially gaining root privileges. As the product line reached its end of service date in March 2026, users are urged to upgrade to mitigate risks.

Affected Version(s)

XWEB EVO 0 < 5.6.2

XWEB EVO 5.6.2

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
patchproduct
https://webapps.copeland.com/dixell/Content/Pages/Adverti...
vendor-advisory
https://www.vulncheck.com/advisories/dixell-copeland-xweb...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.