CVE-2026-124009 | Copeland XWEB EVO up to 5.8.8 Backup backup.lua output device path os command injection

November 12, 2026 Yanac

A vulnerability was found in Copeland XWEB EVO up to 5.8.8. It has been classified as critical. This impacts an unknown function of the file backup.lua of the component Backup. The manipulation of the argument output device path leads to os command injection. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is documented as CVE-2026-124009. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More