CVE-2026-41459 json
Xerte Online Toolkits Path Disclosure via /setup
published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-25073
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 1
- Metasploit
Summary
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
Patch / fix
Timeline
- First public exploit (Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload metasploit exploit, excellent rank, 2026-04-22
- github.com https://github.com/bootstrapbool/xerteonlinetoolkits-rce referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- thexerteproject xerteonlinetoolkits
Classification
- Weakness
-
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
References
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8
patch
-
github.com
/bootstrapbool/xerteonlinetoolkits-rce
technical-description, exploit
-
xerte.org.uk
/xertetoolkits_3.15_ChangeLog.html
release-notes
-
xerte.org.uk
/index.php/en/downloads-1/category/3-xerte-online-toolkits
product, permissions-required
-
github.com
/thexerteproject/xerteonlinetoolkits/issues/1527
issue-tracking
-
vulncheck.com
/advisories/xerte-online-toolkits-path-disclosure-via-setup
third-party-advisory
Sources
- CVE List CVE-2026-41459
- NVD CVE-2026-41459
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.