CVE-2026-32985criticalCWE-306CWE-434

CVE-2026-32985: critical vulnerability in Xerte Online Toolkits

Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution

Published · Updated

Follow this CVE+ Monitor Xerte Online Toolkits

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 1.5%
from disclosure to weaponsame day
Published on NVDMar 20
metasploitAug 4
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Xerte · Xerte Online Toolkits
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.