CVE-2026-32985
Unauthenticated Arbitrary File Upload in Xerte Online Toolkits Enables RCE
Publication date: 2026-03-20
Last updated on: 2026-04-16
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apereo | xerte_online_toolkits | to 3.14.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Xerte Online Toolkits versions 3.14 and earlier have an unauthenticated arbitrary file upload vulnerability in the template import functionality. Specifically, the import.php script lacks authentication checks, allowing an attacker to upload a crafted ZIP archive disguised as a project template.
This ZIP archive can contain a malicious PHP payload placed in the media/ directory, which gets extracted into a web-accessible path. The attacker can then access the uploaded PHP file directly to execute remote code on the web server.
How can this vulnerability impact me? :
This vulnerability allows an attacker to achieve remote code execution on the web server hosting Xerte Online Toolkits. This means the attacker can run arbitrary code with the privileges of the web server, potentially leading to full system compromise.
- Unauthorized access to sensitive data
- Modification or deletion of files
- Deployment of malware or backdoors
- Disruption of service or defacement of websites
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know