CVE-2026-22877 PUBLISHED

Copeland XWEB and XWEB Pro Path Traversal

Assigner: icscert
Reserved: 05.02.2026 Published: 27.02.2026 Updated: 27.02.2026

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Product Status

Vendor Copeland
Product Copeland XWEB 300D PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)
Vendor Copeland
Product Copeland XWEB 500D PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)
Vendor Copeland
Product Copeland XWEB 500B PRO
Versions Default: unaffected
  • affected from 0 to 1.12.1 (incl.)

Solutions

Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.

Credits

  • Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-22 CWE