{"schema":"threatline.record/2","record":{"id":"CVE-2026-117607","aliases":[],"summary":"Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import","details":"Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.","categories":["Unclassified"],"product":"xerteonlinetoolkits","vendor":"thexerteproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117607","source_modified_at":"2026-10-28T02:03:16.664Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"xerteonlinetoolkits","vendor":"thexerteproject","versions":[{"version":"0","status":"affected","versionType":"custom","lessThanOrEqual":"3.15.5"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.6,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T02:03:16.664Z","modified_at":"2026-10-28T02:03:16.664Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117607","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T02:03:16.664Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/thexerteproject/xerteonlinetoolkits","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T02:03:16.664Z","content_hash":"f60cca87830a0a27071e6647af2f7c68d987cd67488034b66e9946bcacb8f34c"}}