7.2
HighCVSS 3.1 · from VulnCheck
CVE-2026-117607
Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
xerteonlinetoolkits · Unrestricted file upload · CWE-434Affectedxerteonlinetoolkits
FixNo fix listed yet.
PublishedOct 28, 02:03 · VulnCheck
ScoredOct 28 · 7.2 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inxerteonlinetoolkitsup to 3.15.5–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known