{"id":"CVE-2026-117607","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-117607","summary":"Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language…","details":"Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.","published":"2026-10-28T02:03:16.664Z","modified":"2026-10-28T02:03:16.664Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"REPORT","url":"https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557"},{"type":"WEB","url":"https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419"},{"type":"WEB","url":"https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211"},{"type":"WEB","url":"https://github.com/thexerteproject/xerteonlinetoolkits"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:03:16.664Z"}}