CVE-2026-4813
Received Received - Intake

Authenticated Remote Code Execution in Lutece Core XSL Export Module

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-4813
EUVD
EUVD-2026-69014

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lutece lutece_core to 7.1.7 (inc)
lutece core to 7.1.7 (inc)
lutece core to 7.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-4813 is a code injection vulnerability in Lutece Core up to version 7.1.7. It allows authenticated administrators to execute arbitrary code remotely via the XSL export management module. The issue occurs because XML/XSLT processing does not enable secure mode, allowing Java extension functions in malicious XSL stylesheets to run.

Detection Guidance

Check for unauthorized XSL files in the Lutece Core export module directories. Review server logs for suspicious export operations or unexpected Java extension function calls during XSLT processing.

Impact Analysis

If you are an administrator using Lutece Core versions 7.1.7 or earlier, an attacker with admin access could upload a malicious XSL file and execute arbitrary code on your server. This could lead to full system compromise, data theft, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or loss of sensitive information, which may violate GDPR, HIPAA, or other compliance requirements. Organizations must patch systems to maintain compliance and protect data integrity.

Mitigation Strategies

Upgrade to Lutece Core version 7.1.9 or later which includes the patch. Ensure FEATURE_SECURE_PROCESSING is enabled in XML/XSLT processing configurations to block Java extension functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4813. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart