CVE-2026-117607: Xerte Online Toolkits Language Pack Import Leads to PHP Code Execution

Executive Summary

CVE-2026-117607 is a remote code execution vulnerability in Xerte Online Toolkits through version 3.15.5. An authenticated user holding system-level permission can execute arbitrary PHP on the server by importing a crafted language pack. It was published to the NVD on 2026-10-28 (assigned by VulnCheck).

Technical Details

According to the public report in the upstream GitHub issue (#1557):

1. The language-pack validation blocks path traversal and extensions such as .php, but explicitly allows .inc members, which PHP will execute in this application.
2. import_language.php writes the accepted ZIP contents into the language and wizard directories without treating them as data-only resources.
3. functions.php later loads the selected language file with require_once(), so a request that selects the planted language through the language parameter runs the attacker's code.

The reporter notes this is not a ZIP Slip issue: the archive path checks keep files inside the intended directories. The problem is that the files placed there are executable.

Impact

Successful exploitation gives code execution in the context of the web server user. That typically exposes the application database credentials, uploaded learning content, and any other data readable by the web process, and can serve as a foothold for further movement. The high-privilege requirement limits exposure, but Xerte deployments in education often have several administrators, and a compromised or malicious admin account is enough.

Remediation

• Check the Xerte project's GitHub issue and the VulnCheck advisory for a fixed release, and upgrade beyond 3.15.5 once available. Sources did not name a patched version at the time of writing.
• Restrict system-level permission to the minimum number of trusted accounts and review who currently holds it.
• Audit the language and wizard directories for unexpected .inc or other executable files.
• If the language import feature is not needed, block access to import_language.php at the web server.
• Review web server logs for requests to import_language.php followed by requests using unusual language parameter values.

References

• NVD: CVE-2026-117607
• Xerte Online Toolkits issue #1557
• VulDB entry