CVE-2026-117607
xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
thexerteproject xerteonlinetoolkits
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
Text from CVE List
Affected versions 1
- xerteonlinetoolkitsaffected: all versions through 3.15.5CVE List
References 5
- vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-importAdvisoryvia CVE List
- github.com/thexerteproject/xerteonlinetoolkits/issues/1557Referencevia CVE List
- github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419Referencevia CVE List
- github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211Referencevia CVE List
- github.com/thexerteproject/xerteonlinetoolkitsReferencevia CVE List