CVE-2026-117607

HIGH 7.2

Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.

CWE	CWE-434
Vendor	thexerteproject
Product	xerteonlinetoolkits
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for thexerteproject xerteonlinetoolkits

Be the first to know when new high vulnerabilities affecting thexerteproject xerteonlinetoolkits are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

thexerteproject / xerteonlinetoolkits

0 ≤ 3.15.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557 github.com: https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419 github.com: https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211 github.com: https://github.com/thexerteproject/xerteonlinetoolkits vulncheck.com: https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import

Credits

cxc