CVE-2026-32985
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.48% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306, CWE-434
- Affected
- apereo/xerte online toolkits
- Source
- disclosure@vulncheck.com
References
- https://packetstorm.news/files/id/216288/Exploit, Issue Tracking, Third Party Advisory
- https://xot.xerte.org.uk/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.