CVE-2026-117607
Received Received - Intake

Remote Code Execution in Xerte Online Toolkits

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-117607
EUVD
EUVD-2026-111542

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thexerteproject xerteonlinetoolkits 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote code execution flaw in Xerte Online Toolkits through version 3.15.5. Authenticated users with system permissions can upload a malicious ZIP file containing a PHP .inc file via import_language.php. The application then executes this file when the language parameter is used, allowing attackers to run arbitrary PHP code on the server.

Detection Guidance

Check for suspicious language pack uploads via import_language.php. Look for unexpected .inc files in language directories. Monitor for unauthorized PHP execution attempts through the language parameter in requests.

Impact Analysis

An attacker could exploit this to read sensitive files, execute commands on the server, or take full control depending on PHP process permissions. Since it requires authenticated system access, the risk is higher for users with elevated privileges.

Compliance Impact

This RCE vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Xerte Online Toolkits to a version beyond 3.15.5. Restrict system permissions for users who can upload language packs. Block access to import_language.php if not needed. Review uploaded language packs for unexpected .inc files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart