Xerte Online Toolkits: Authenticated remote code execution (CVE-2026-117607)
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack.
CVE search metadata
CVE search record: CVE-2026-117607. Severity: high. CVSS: 7.2. KEV: no. Product: Xerte Online Toolkits (through 3.15.5). Brief: Xerte Online Toolkits: Authenticated remote code execution (CVE-2026-117607). Brief link: https://feed.craftedsignal.io/briefs/2026-10-xerte-rce/
Triage facts
Revision 1- Applicability
- Xerte Online Toolkits (through 3.15.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 08:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability. Authenticated users with system permissions can run PHP code by importing a crafted language pack. Attackers can upload a ZIP file via import_language.php containing a .inc file and request it through the language parameter to execute code on the server.