Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-41459.
Includes Metasploit module exploits/multi/http/xerte_unauthenticated_mediaupload.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Xerte Online Toolkits by bypassing authentication, extension blacklists, and path traversal restrictions to upload and execute a PHP shell.
Description
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
Exploits (1)
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Xerte Online Toolkits by bypassing authentication, extension blacklists, and path traversal restrictions to upload and execute a PHP shell.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N