CVE-2026-124013

CVSS 8.8 (high) · published 2026-11-12

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.

Weakness: CWE-78

Source: NVD CVE-2026-124013

References

• https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
• https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf
• https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua
• https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.