VULNERABILITY INTELLIGENCE

CVE-2026-32985

CVSS score9.8 CRITICAL

EPSS probability1.50%

CISA KEVNot currently listed

Published2026-03-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.

Weakness classification

disclosure@vulncheck.com: CWE-306
nvd@nist.gov: CWE-434

Primary references

disclosure@vulncheck.com — Exploit, Issue Tracking, Third Party Advisory
disclosure@vulncheck.com — Product