Xerte Online Toolkits: Remote code execution via language pack import
Summary
Xerte Online Toolkits through version 3.15.5 allows an authenticated user with system permission to run PHP code on the server. The attacker uploads a ZIP archive containing a crafted .inc file through the language pack import function and then requests it via the language parameter. Exploitation requires high privileges, but a successful attack gives full control over the web server and its data.
Affected
- Xerte Online Toolkits through 3.15.5
- Vendor data: thexerteproject xerteonlinetoolkits, versions 0 to 3.15.5 affected
Fixed in
Unknown. No confirmed fixed version for this issue.
Workaround
- Restrict system permission access to trusted administrators only
- Review who can use the language pack import function
- Log and alert on requests to import_language.php and on access through the language parameter
Exploitation
- No confirmed exploitation in the wild at the time of writing
- Not listed in CISA KEV according to a third-party tracker
- No public exploit code indexed in Metasploit or Exploit-DB
- A October 2025 researcher write-up describes a related upload issue in the same import endpoint; it is not confirmed to be the same bug
Our recommendation
- Check whether an installed Xerte instance is version 3.15.5 or earlier and whether it is reachable from the internet
- Limit administrator accounts to a few trusted staff and remove unused system permission accounts
- Restrict or disable the language pack import function if possible, and ask the vendor for the fix status
- Monitor import activity and web server logs for suspicious PHP files
- Re-check NVD and CISA KEV in the coming days, as the NVD analysis is still pending
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- NVD record via Vulners vulners.com
- VulDB CVE entry vuldb.com
- GitHub issue 1557 github.com
- Vulnerable code functions.php github.com
- Vulnerable code import_language.php github.com
- Xerte news blog xerte.org.uk
- Xerte downloads xerte.org.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:57.
Original description (NVD)
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
NVD references (5)
- https://github.com/thexerteproject/xerteonlinetoolkits
- https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/function…
- https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_…
- https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557
- https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.