Threats tagged 'ghsa-82r9-888q-6v25'

XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling. This flaw allows authenticated attackers to inject unescaped template source into shell commands executed via the wlua interpreter, enabling arbitrary command execution with root privileges. The product line is supported until March 2026.