Threats tagged 'ghsa-55x9-xqqc-c745'

XWEB EVO versions 5.6.2 through 5.8.8 contain an authenticated OS command injection vulnerability in the api.lua file's import_preconfiguration and restore actions. The vulnerability arises because server_url and related credential fields are concatenated without escaping into a root-level curl command executed via io.popen. This allows authenticated attackers to inject arbitrary shell commands, leading to command execution with root privileges. The product line is scheduled for end of service in March 2026.