Remote Code Execution Vulnerability in Lutece Core Export Management Module
CVE-2026-4813

9.4CRITICAL

Key Information:

Vendor

Lutece

Status
Lutece Core
Vendor
CVE Published:
1 September 2026

What is CVE-2026-4813?

A vulnerability in the Lutece Core XSL export management module allows authenticated administrators to execute arbitrary code remotely due to the absence of secure processing mode in XML/XSLT processing configuration. Attackers with administrator privileges can exploit this flaw by uploading a crafted XSL transformation file, leading to the execution of malicious Java extensions during user export operations. This poses a significant risk to server integrity and data security.

Affected Version(s)

Lutece Core 0 < 7.1.7

References

http://incibe.es/en/incibe-cert/notices/aviso/code-inject...
patch

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dorian Piette (Trachinus).
.