OS Command Injection Vulnerability in Dixell/Copeland XWEB EVO Product Line
CVE-2026-124013

8.7HIGH

Key Information:

Vendor

Copeland

Status
Xweb Evo
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124013?

The XWEB EVO software suite, versions 5.6.2 to 5.8.8 from Dixell/Copeland, is plagued by an authenticated OS command injection vulnerability. This flaw resides within the 'api.lua' where the import_preconfiguration and restore actions allow for unvalidated parameters in server_url and server credential fields. Consequently, attackers may exploit these unescaped inputs, injecting malicious shell commands that execute with root privileges on the underlying system. It's crucial for users to be aware as this product line reached its end of service date in March 2026.

Affected Version(s)

XWEB EVO 5.6.2 <= 5.8.8

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
patchproduct
https://webapps.copeland.com/dixell/Content/Pages/Adverti...
vendor-advisory
https://www.vulncheck.com/advisories/dixell-copeland-xweb...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.