CVE-2026-117607 in Xerte Online Toolkits
Summary
by MITRE • 10/28/2026
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Xerte Online Toolkits software, specifically versions up to and including 3.15.5, contains a critical remote code execution vulnerability that stems from improper validation of user-supplied input during the importation of language packs. This flaw is located within the application's administrative interface, where authenticated users possessing system-level permissions can interact with the import_language.php endpoint. The core technical issue arises because the software fails to adequately sanitize or restrict file types and content structures when processing uploaded ZIP archives intended for localization updates. An attacker who has obtained valid credentials with sufficient privileges can exploit this lack of input validation by crafting a malicious archive that contains PHP code disguised as part of a language pack, specifically within an .inc include file.
The exploitation mechanism involves two distinct phases: upload and execution. First, the adversary constructs a ZIP file containing a specially crafted .inc file embedded with arbitrary PHP commands. This payload is then uploaded to the server via the import_language.php script, which accepts the archive without sufficiently verifying that the contents are strictly limited to expected language definition formats such as plain text or standard configuration arrays. Once the malicious file is stored on the filesystem under a predictable path determined by the application's logic, the attacker triggers execution by sending an HTTP request with a specific value in the language parameter. This parameter directs the script to include and execute the uploaded .inc file within the current PHP context, thereby granting the attacker the ability to run arbitrary system commands with the same privileges as the web server process.
This vulnerability is classified under CWE-94 Improper Control of Generation of Code (Code Injection) because it allows an actor to inject executable code into a program through unsanitized input. Furthermore, from a tactical perspective aligned with the MITRE ATT&CK framework, this exploit maps directly to T1505.003 Server Component Binary Implanting and T1059 Command and Scripting Interpreter: PHP. The ability to execute arbitrary code on the server represents a severe compromise of confidentiality, integrity, and availability. An attacker can leverage this access to exfiltrate sensitive data stored within the Xerte database, modify educational content managed by the platform, or use the compromised server as a pivot point for further lateral movement within the internal network infrastructure.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade Xerte Online Toolkits to version 3.15.6 or later, where this input validation flaw has been addressed by implementing stricter file type restrictions and content sanitization during the language pack import process. In environments where an immediate patch is not feasible, temporary mitigations include restricting access to administrative endpoints via network segmentation or firewall rules that limit connectivity to trusted IP addresses only. Additionally, enforcing strict least-privilege principles for user accounts can reduce the attack surface by ensuring that fewer users possess the system permissions required to trigger the import functionality. Web Application Firewalls may also be configured to detect and block requests containing suspicious patterns associated with PHP code injection or unusual file type uploads in language-related parameters.