CVE-2026-32985
Published: 20 March 2026
Description
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass…
more
authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
Mitigating Controls (NIST 800-53 r5)AI
Defines and restricts permitted actions without authentication, ensuring template import functionality requires identification to prevent unauthenticated arbitrary file uploads.
Validates inputs to the template import endpoint, including ZIP archive contents, to block malicious PHP payloads and dangerous file types.
Deploys malicious code protection at web application entry points to scan and eradicate uploaded PHP payloads before extraction to web-accessible paths.
Security SummaryAI
Xerte Online Toolkits versions 3.14 and earlier are affected by CVE-2026-32985, an unauthenticated arbitrary file upload vulnerability in the template import functionality. This flaw, tied to CWE-306 (Missing Authentication for Critical Function) and CWE-434 (Unrestricted Upload of File with Dangerous Type), exists in the import.php file, where attackers can bypass authentication checks to upload a crafted ZIP archive containing malicious PHP payloads. The archive extracts the PHP code to a web-accessible media directory, enabling direct access and execution under the web server context. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require no privileges or user interaction to exploit this issue over the network. By submitting a specially crafted ZIP file via the template import endpoint, they achieve arbitrary code execution on the server, potentially leading to full compromise including data theft, modification, or destruction under the web server's permissions.
Mitigation details and patches are referenced in advisories available at https://packetstorm.news/files/id/216288/ and the project site https://xot.xerte.org.uk/. Security practitioners should review these sources for upgrade instructions or workarounds to address the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary file upload in public-facing web application enables remote code execution via crafted PHP payloads acting as web shells (T1190: Exploit Public-Facing Application; T1100: Web Shell).