Threats tagged 'ghsa-x5q2-4j2q-cpfm'

XWEB EVO versions 4.3.0 through 5.8.8 have an unauthenticated arbitrary file write vulnerability. Remote attackers can send crafted POST requests to config.lua with action=set, which lacks session validation and writes unvalidated data to /etc/xwebconfig.json. This allows attackers to modify system configuration, tamper with model and plugin fields, or trigger a denial of service by causing a SYSTEM_NOT_CONFIGURED state. The product line reached end of service in March 2026.