Description
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Copeland | XWEB EVO | < 5.6.2 | 5.6.2 |
References
- Software Download patch product
- End of Support Announcement vendor-advisory
- VulnCheck Advisory: Dixell/Copeland XWEB EVO Setuid Lua CGI Root Command Injection third-party-advisory
- VulnCheck Blog technical-description exploit