Remote Code Execution Vulnerability in Xerte Online Toolkits

CVE-2026-117607

What is CVE-2026-117607?

Xerte Online Toolkits, up to version 3.15.5, is vulnerable to a remote code execution issue that could be exploited by authenticated users with system permissions. By importing a specially crafted language pack, attackers can upload a malicious ZIP file containing PHP code through the script 'import_language.php'. Once uploaded, they can execute this code on the server by leveraging the language parameter, posing a significant threat to system integrity and security.

References