CVE-2026-4813 in Lutece
Summary
by MITRE • 09/01/2026
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within Lutece Core versions up to 7.1.7 represents a critical security flaw rooted in improper configuration of XML processing features, specifically concerning XSLT transformations. This issue falls under the category of insecure default configurations and insufficient validation of external resources, aligning with CWE-94 Improper Control of Generation of Code or Script, often referred to as code injection via server-side template engines or processors. The core technical flaw lies in the absence of secure processing mode during XML/XSLT operations. In Java-based environments, the javax.xml.transform package provides a feature known as FEATURE_SECURE_PROCESSING which restricts access to certain external resources and limits resource consumption to prevent denial-of-service attacks and arbitrary code execution. When this flag is not explicitly enabled or properly configured, the XSLT processor defaults to allowing unrestricted access to system features, including Java extension functions that can invoke native methods or execute shell commands directly on the host operating system.
The operational impact of this vulnerability is severe due to its reliance on authenticated administrator privileges for exploitation. While remote code execution vulnerabilities are often sought after by attackers seeking immediate control over a target infrastructure, this specific flaw requires an initial foothold as an administrative user. An attacker who has compromised or obtained valid credentials for an account with administrative rights can exploit the XSL export management module to achieve full system compromise. The attack vector involves uploading a maliciously crafted XSL transformation file that contains embedded Java extension functions designed to execute arbitrary commands. Once uploaded, this stylesheet is triggered during legitimate user data export operations performed by other administrators or automated systems within the application workflow. This mechanism allows the attacker to bypass typical network-based intrusion detection systems since the traffic appears as normal administrative activity and internal application processing rather than external exploitation attempts.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK techniques related to Command and Scripting Interpreter execution via server-side components. Specifically, it aligns with T1059.004 which covers Unix Shell commands executed through system-level interfaces available within application logic. The exploitation chain demonstrates how trusted administrative functions can be subverted when underlying libraries are not hardened against malicious input structures. The ability to execute arbitrary code remotely via this vector means that an attacker could install backdoors, exfiltrate sensitive data stored in the Lutece database, pivot to other systems on the internal network, or escalate privileges further if additional misconfigurations exist within the server environment hosting the application.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary corrective action is to upgrade the Lutece Core software to version 7.1.8 or later where this configuration issue has been resolved by enforcing secure processing modes by default for all XSLT transformations. For environments unable to immediately patch, administrators should implement a Web Application Firewall rule set that detects and blocks XML payloads containing suspicious Java extension function calls such as javax.script.ScriptEngineManager or Runtime.getRuntime().exec patterns within uploaded files. Additionally, implementing strict file upload validation mechanisms is crucial; this includes verifying the content type of uploaded XSL files against expected schemas rather than relying solely on file extensions which can be spoofed. Principle of least privilege should also be enforced by restricting administrative export functions to only those users who absolutely require them and monitoring logs for unusual spikes in export activities following new stylesheet uploads. Regular security audits focusing on third-party library configurations, particularly XML parsers and transformers, are essential to prevent similar misconfigurations from persisting in other modules or future versions of the platform.