{"id":"CVE-2026-117607","kind":"vulnerability","aliases":["CVE-2026-117607"],"related":[],"title":"Xerte Online Toolkits: crafted language pack import runs PHP on server","description":"Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.","summary":"Xerte Online Toolkits through 3.15.5 lets a user with system permission upload a ZIP language pack containing a .inc file via import_language.php. Requesting that file through the language parameter makes the server execute the attacker's PHP code.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-learning","package","php","self-hosted","xerte"],"not_affected_if":["import-blocked","no-system-permission-users"],"how_to_check":"- Check the installed Xerte version against `3.15.5` in the application's version file or admin page\n- Confirm whether `import_language.php` is reachable on the deployed instance\n- unknown for exact file paths and version location","fix":"- Move to a Xerte Online Toolkits release newer than `3.15.5`\n- Restrict or remove system-permission accounts until patched\n- unknown for an official patched version number in the sources","status":"open","published_at":"2026-10-28T03:17:12+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:22+00:00","updated_at":"2026-10-28T03:32:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Xerte Online Toolkits release newer than `3.15.5`\n- Restrict or remove system-permission accounts until patched\n- unknown for an official patched version number in the sources","reach":"internet","title":"Xerte Online Toolkits: crafted language pack import runs PHP on server","impact":"high","summary":"Xerte Online Toolkits through 3.15.5 lets a user with system permission upload a ZIP language pack containing a .inc file via import_language.php. Requesting that file through the language parameter makes the server execute the attacker's PHP code.","category":"package","nicknames":[],"who_cares":["xerte","php","self-hosted","e-learning"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs PHP code on the server as the web user","analyst_note":"Confirm the patched version and the exact check for import_language.php from the NVD entry or the Xerte project advisory.","how_to_check":"- Check the installed Xerte version against `3.15.5` in the application's version file or admin page\n- Confirm whether `import_language.php` is reachable on the deployed instance\n- unknown for exact file paths and version location","needs_analyst":true,"not_affected_if":["no-system-permission-users","import-blocked"],"who_is_affected":"Sites running Xerte Online Toolkits 3.15.5 or earlier where users hold system permission and can reach the language pack import feature. Instances with no system-permission users or with the import path blocked are less exposed. Teams not running Xerte can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":3323,"output_tokens":566,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117607':14A,17A '-2026':13A,16A '3.15.5':31B,69C 'allow':77C 'attack':61B,92C 'authent':78C 'code':64B,73C,112C 'contain':43B,70C,99C 'craft':4A,89C 'cve':12A,15A 'e':19B 'e-learn':18B 'execut':59B,74C,111C 'file':46B,51B,102C 'host':25B 'import':7A,87C 'import_language.php':48B,98C 'inc':45B,101C 'languag':5A,41B,54B,90C,108C 'learn':20B 'let':32B 'make':56B 'onlin':2A,28B,66C 'pack':6A,42B,91C 'packag':21B 'paramet':55B,109C 'permiss':37B,82C 'php':9A,22B,63B,85C 'remot':72C 'request':49B,104C 'run':8A,84C 'self':24B 'self-host':23B 'server':11A,58B,115C 'system':36B,81C 'toolkit':3A,29B,67C 'upload':38B,94C 'user':34B,79C 'via':47B,97C 'vulner':75C 'xert':1A,26B,27B,65C 'zip':40B,96C","nicknames":[],"mitigations":[],"who_affected":"Sites running Xerte Online Toolkits 3.15.5 or earlier where users hold system permission and can reach the language pack import feature. Instances with no system-permission users or with the import path blocked are less exposed. Teams not running Xerte can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117607","severity":null,"published_at":"2026-10-28T03:17:12+00:00","modified_at":"2026-10-28T03:17:12+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}