High severity · published Oct 28, 2026
CVE-2026-117607
Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
New
7.2
CVSS
–
EPSS
No
On KEV
Description
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
xerteonlinetoolkits · thexerteproject
through 3.15.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117607
issue-tracking
https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557
technical-description
https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419
technical-description
https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211
product
https://github.com/thexerteproject/xerteonlinetoolkits
third-party-advisory
https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import
More from xerteonlinetoolkits
9.8
CVE-2026-34415
Xerte Online Toolkits File Upload RCE via elfinder Connector
8.6
CVE-2026-34413
Xerte Online Toolkits Missing Authentication via connector.php
7.1
CVE-2026-34414
Xerte Online Toolkits Path Traversal via connector.php
5.3
CVE-2026-41459
Xerte Online Toolkits Path Disclosure via /setup