High-severity OS command injection flaw in Copeland XWEB EVO

## Overview Copeland XWEB EVO versions 5.6.2 through 5.8.8 contain a high-severity vulnerability identified as CVE-2026-124013. This flaw allows authenticated users to execute arbitrary commands on the underlying system with root privileges. ## Technical Details The vulnerability resides in the `api.lua` file, specifically within the `import_preconfiguration` and `restore` actions. It occurs because the `server_url` and related server credential fields are concatenated unescaped into a root curl command executed via `io.popen`. Attackers can exploit this by injecting malicious shell commands through these unfiltered parameters. ## Impact Successful exploitation of this vulnerability can lead to arbitrary command execution on the affected systems. This poses a significant risk, especially since the product line reached its end of service date in March 2026, meaning no further updates or patches will be provided. ## Mitigation Defenders should prioritize upgrading to a secure version of the Copeland XWEB EVO software. Given the end of service status, organizations using affected versions should consider migrating to a supported product or implementing additional security measures to mitigate the risk of exploitation.