Live › vulnerability › CVE-2026-117607
Go to dashboardXerte Online Toolkits through 3.15.5 lets a user with system permission upload a ZIP language pack containing a .inc file via import_language.php. Requesting that file through the language parameter makes the server execute the attacker's PHP code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Sites running Xerte Online Toolkits 3.15.5 or earlier where users hold system permission and can reach the language pack import feature. Instances with no system-permission users or with the import path blocked are less exposed. Teams not running Xerte can skip it.
No product ranges from the sources yet.
3.15.5 in the application's version file or admin pageimport_language.php is reachable on the deployed instance3.15.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-117607")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.