Threats tagged 'ghsa-pxcj-mc47-xhg9'

XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability. Authenticated attackers can inject shell metacharacters into the output device path parameter processed by backup.lua, leading to arbitrary command execution as root. This occurs due to unescaped concatenation into shell commands executed via the wlua interpreter, including through setuid interfaces xwbackup.cgi and xwrestore.cgi. The product line reached end of service in March 2026.