{"id":"CVE-2026-117607","title":"Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import","summary":"Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.ph…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-434"],"vendor":"thexerteproject","product":"xerteonlinetoolkits","affected":["xerteonlinetoolkits <= 3.15.5"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-11-02T19:54:39.926068Z"},"exploitAvailable":true,"published":"2026-10-28","updated":"2026-11-02","sourceUpdated":"2026-11-02T19:55:05.548Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117607","references":[{"url":"https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557"},{"url":"https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419"},{"url":"https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211"},{"url":"https://github.com/thexerteproject/xerteonlinetoolkits"},{"url":"https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import","label":"VulnCheck Advisory: Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import"}],"tags":["cve.org","exploit-available"],"epss":0.00684,"epssPercentile":0.52835,"ingestedAt":"2026-10-28T03:02:57.629Z","slug":"CVE-2026-117607","body":"## Overview\n\nXerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.\n\n## Affected\n\n- `xerteonlinetoolkits <= 3.15.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":233562,"id":"CVE-2026-117607","ts":1793907129616,"field":"exploit_available","old":"false","new":"true"}]}