CVE-2026-32985 | Xerte Online Toolkits versions 3.14 and earlier contain an u… | CVSS 9.8 CRITICAL

Description

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.

Metadata

CVE ID: CVE-2026-32985
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-03-17 11:31 UTC
Published: 2026-03-20 00:06 UTC
Last updated: 2026-07-14 18:40 UTC
Primary CWE: CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product: Xerte / Xerte Online Toolkits
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Xerte	Xerte Online Toolkits	—	0 ≤ 3.14

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306 Missing Authentication for Critical Function
CWE-434	cna	CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)

Xerte Online Toolkits - Vendor Homepage https://xot.xerte.org.uk/
Packet Storm listing (Xerte Online Toolkits 3.14 Shell Upload) https://packetstorm.news/files/id/216288/