CVE-2026-117607

Name of the Vulnerable Software and Affected Versions Xerte Online Toolkits versions prior to 3.15.6

Description Authenticated users with system permissions can achieve remote code execution by importing a specially crafted language pack. An attacker can upload a ZIP archive containing a .inc file via the 'import language.php' endpoint and subsequently trigger the execution of PHP code on the server by requesting it through the language parameter.

Recommendations Update Xerte Online Toolkits to version 3.15.6 or later. Restrict access to the 'import language.php' endpoint to minimize the risk of exploitation.