CVE-2026-32985: apereo xerte_online_toolkits

Vulnerability summary

CVE-2026-32985 is a critical (CVSS 9.8) vulnerability in apereo xerte_online_toolkits. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-03-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.