CVE-2026-124003 Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection
Attackers can inject commands via a setuid-root Lua CGI on XWEB EVO, executing as root; the product is end-of-service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-124003?
CVE-2026-124003 is a high-severity command injection vulnerability in Copeland XWEB EVO, published on 12 Nov 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.
Weakness: CWE-250
Which versions are affected by CVE-2026-124003?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-124003?
No fix has been published for CVE-2026-124003 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-124003 being exploited?
There is no known exploitation of CVE-2026-124003 in the wild and no public exploit code.
Sources
Also known as GHSA-r68m-c6rg-86pf.