CVE-2026-117607
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
Risk Assessment
An authenticated attacker with system permission can execute arbitrary code on the server, taking over the application and its data. The risk is high because it only requires system permissions, which may be granted more broadly than administrator.
Recommendation
Update Xerte Online Toolkits to a version later than 3.15.5. Restrict system permissions to the necessary minimum and validate imported language packs.
Other vulnerabilities in Xerte Online Toolkits
See all- CVE-2026-34415Critical
Xerte Online Toolkits versions 3.15 and earlier have an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block the .php4 extension due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal to upload malicious PHP code and execute arbitrary system commands on the server.
- CVE-2026-41459Medium
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response.
- CVE-2026-34414High
A relative path traversal vulnerability in Xerte Online Toolkits versions 3.15 and earlier allows attackers to move files from project media directories to arbitrary filesystem locations via an unsanitized 'name' parameter in the rename command of the elFinder connector. This can lead to overwriting application files, stored cross-site scripting, or when combined with other vulnerabilities, unauthenticated remote code execution by moving PHP files to the application root.
- CVE-2026-34413High
Xerte Online Toolkits versions 3.15 and earlier have a missing authentication vulnerability in the elFinder connector endpoint. An HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side.
Original NVD description (English source)
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS