HIGHCVSS v3.1 7.8Vulnerability
CVE-2026-124003
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00686
- Cvss severity
- HIGH
- Cvss score
- 7.8
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 7.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-124003
- Cvss vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-13T00:03:24+00:00
- Name
- CVE-2026-124003
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-12T20:18:21.917
- Last modified
- 2026-11-13T15:17:34.417
- Epss percentile
- 0.53173
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph