CVE-2026-41459

MEDIUM

Xerte Online Toolkits Path Disclosure via /setup

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-41459. Includes Metasploit module exploits/multi/http/xerte_unauthenticated_mediaupload.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Xerte Online Toolkits by bypassing authentication, extension blacklists, and path traversal restrictions to upload and execute a PHP shell.

Description

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.

Exploits (1)

metasploit WORKING POC EXCELLENT
rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/xerte_unauthenticated_mediaupload.rb

This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Xerte Online Toolkits by bypassing authentication, extension blacklists, and path traversal restrictions to upload and execute a PHP shell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Xerte Online Toolkits versions 3.15 (commit 4e40f8030a2e3267267db7ce03e0ff57270be6f5) and earlier
No auth needed
Prerequisites: Access to the target's /editor/elfinder/php/connector.php endpoint · Default or known project structure
mistral-large-3 · analyzed Jun 16, 2026 Full analysis →

Scores

CVSS v3 5.3
EPSS 0.0080
EPSS Percentile 53.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-497
Status published
Products (2)
thexerteproject/xerteonlinetoolkits < f063e942b4a9bf77a06829e844c2c70316bc45e8
thexerteproject/xerteonlinetoolkits 3.15.0
Published Apr 22, 2026
Tracked Since Apr 23, 2026