CVE-2026-32985
Received Received - Intake
Unauthenticated Arbitrary File Upload in Xerte Online Toolkits Enables RCE

Publication date: 2026-03-20

Last updated on: 2026-04-16

Assigner: VulnCheck

Description
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-04-16
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-32985
EUVD
EUVD-2026-13416
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apereo xerte_online_toolkits to 3.14.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

Xerte Online Toolkits versions 3.14 and earlier have an unauthenticated arbitrary file upload vulnerability in the template import functionality. Specifically, the import.php script lacks authentication checks, allowing an attacker to upload a crafted ZIP archive disguised as a project template.

This ZIP archive can contain a malicious PHP payload placed in the media/ directory, which gets extracted into a web-accessible path. The attacker can then access the uploaded PHP file directly to execute remote code on the web server.

Impact Analysis

This vulnerability allows an attacker to achieve remote code execution on the web server hosting Xerte Online Toolkits. This means the attacker can run arbitrary code with the privileges of the web server, potentially leading to full system compromise.

  • Unauthorized access to sensitive data
  • Modification or deletion of files
  • Deployment of malware or backdoors
  • Disruption of service or defacement of websites
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart