EUVD-2026-111542
GHSA-w4qr-gppq-v53c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as system-permission user
-
DeliveryUpload crafted ZIP via import_language.php
-
ExploitDrop malicious .inc PHP file
-
ExecutionRequest file via language parameter
-
ImpactExecute arbitrary PHP on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with Xerte 'system' permission (reflected as PR:H) and access to the language-pack import feature at import_language.php. The concrete prerequisite chain is: upload a crafted ZIP archive containing a .inc file, then issue a request referencing it through the 'language' parameter to trigger PHP execution via functions.php. The primary limiting factor is the high-privilege requirement - this is not reachable by anonymous or low-privilege users - so realistic risk is confined to environments with multiple or semi-trusted privileged operators, shared admin credentials, or where such an account can be compromised. No user interaction by a victim is required (UI:N). |
| Impact | This is a genuine but privilege-gated RCE. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.6) describes network-reachable, low-complexity code execution with full confidentiality, integrity and availability impact on the vulnerable system, but PR:H means the attacker must already hold a high-privilege account - the description confirms this as a user with 'system permission.' The vuln.today priority is 'this_week,' reported by VulnCheck, which signals meaningful but not emergency urgency. No EPSS score, no CISA KEV listing, and no confirmed working exploit code are present in the input, so there is no signal of active or widespread exploitation; the risk is driven by severity-of-outcome rather than ease-of-access. Net: a real priority to patch for anyone running Xerte with semi-trusted privileged users or shared admin access, but the PR:H barrier substantially limits mass or unauthenticated exploitation, so it is not a drop-everything emergency absent a KEV/EPSS signal. The CVSS network vector and the description are consistent (import occurs over the web app), so no contradiction to flag. |
| Exploit ScenarioDerived | An attacker who holds (or has phished/escalated to) an account with Xerte 'system' permission logs into the web application and uses the language-pack import feature to upload a crafted ZIP containing a malicious .inc PHP file. They then request that file via the language parameter, causing the server to execute their PHP code. A VulnCheck advisory and the upstream GitHub issue describe the flaw, but the input does not confirm working public exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Authenticated users holding the Xerte Online Toolkits 'system' permission can execute PHP on servers running versions through 3.15.5 by importing a crafted language-pack ZIP that contains a .inc file and then requesting that file through the language parameter. The upload path is import_language.php and execution is reached through functions.php, so a privileged attacker can turn a permitted language-import workflow into remote code execution. The high-privilege requirement confines realistic exposure to deployments with multiple trusted operators, shared administrative credentials, or a compromised system-level account; no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied references; the links point to the vendor issue and source-code locations rather than a tagged fixed release, so track https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557 and https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import for a fixed release and upgrade once a version later than 3.15.5 is confirmed. Until then, reduce the documented prerequisite exposure by limiting the Xerte 'system' permission and access to import_language.php to fully trusted operators, removing unnecessary system-level accounts, and eliminating shared administrative credentials; these controls trade off administrative convenience but directly narrow the PR:H path. If the language-import feature is not needed, disable it, and consider blocking PHP execution in the language-pack storage location at the web server as a compensating control, with the side effect that legitimate language functionality may break.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Xerte Online Toolkits is a PHP web application for creating and delivering e-learning content, and the supplied CPE is cpe:2.3:a:thexerteproject:xerteonlinetoolkits:*:*:*:*:*:*:*:* with the description bounding affected releases through 3.15.5. The weakness class is CWE-434 (Unrestricted Upload of File with Dangerous Type): import_language.php handles a ZIP language pack and its .inc member, while functions.php line 419 is the code location tied to loading language content. The references identify import_language.php line 211 and functions.php line 419 as the relevant implementation points. Because the imported .inc file can contain PHP in this path, a request that references the uploaded file through the language parameter can cause the server to interpret it as PHP. The provided CVSS 4.0 vector describes a network-reachable issue with low attack complexity, high privileges required (PR:H), no user interaction, and high confidentiality, integrity, and availability impact; the trigger described in the sources requires the upload-then-request sequence and is not reachable anonymously.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable import feature (AV:N, AC:L) but requires a high-privilege 'system' account (PR:H); successful upload yields full server code execution, so C:H/I:H/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
Executive ViewAI
CVE-2026-117607 is a high-severity vulnerability in Xerte Online Toolkits (through v3.15.5) that enables authenticated users with the 'system' permission to achieve remote code execution by importing a malicious language pack. This effectively converts a legitimate administrative capability into a server takeover primitive. Leadership should be concerned because these 'system' accounts often represent trusted administrators with broad access; any compromise or insider misuse could lead to full server compromise, data exfiltration, or service disruption across the learning platform.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) strictly limit the 'system' permission to a minimal set of trusted administrators; (2) disable or restrict access to the language-import functionality (e.g., via web server configuration or file removal) if not operationally required; (3) enforce multi-factor authentication and least privilege for all administrative accounts; (4) deploy file integrity monitoring and anomaly detection for unexpected PHP file creation in language directories; (5) consider a web application firewall rule to block requests to import_language.php from untrusted sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB