Information Disclosure Vulnerability in Xerte Online Toolkits by Xerte

CVE-2026-41459

What is CVE-2026-41459?

Xerte Online Toolkits versions 3.15 and earlier are susceptible to an information disclosure flaw that permits unauthorized users to obtain the complete server-side filesystem path of the application root. By issuing a GET request to the /setup endpoint, attackers can exploit this vulnerability to retrieve the root_path value from the HTML response. This exposure can lead to further security issues, such as relative path traversal attacks in the connector.php file, potentially compromising system integrity and confidentiality.

References