Mesalvo Meona Code Injection Vulnerability Allowing Remote Code Execution

A code injection vulnerability has been identified in the Mesalvo Meona Client Launcher and Server components. This vulnerability allows for arbitrary code execution on the systems of other users. It affects the Meona Client Launcher through version 19.06.2020 15:11:49 and the Meona Server Component through version 2025.04 5+323020.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the client systems where Meona is running.

Reproduction

The vulnerability can be reproduced by adding scripts in various programming languages or by modifying XML-based configurations through administrative features of the Meona application. Once the code is injected via these methods, it is executed on the client systems running Meona.