CVE-2026-32985: Xerte Online Toolkits RCE Vulnerability

CVE-2026-32985 Overview

CVE-2026-32985 is an unauthenticated arbitrary file upload vulnerability affecting Xerte Online Toolkits versions 3.14 and earlier. The vulnerability exists in the template import functionality and allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.

Critical Impact

Remote attackers can achieve full code execution on vulnerable Xerte Online Toolkits servers without any authentication, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• Xerte Online Toolkits version 3.14
• Xerte Online Toolkits versions prior to 3.14
• All Xerte Online Toolkits installations with exposed template import functionality

Discovery Timeline

• 2026-03-20 - CVE-2026-32985 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-32985

Vulnerability Analysis

This vulnerability stems from Missing Authentication for Critical Function (CWE-306) in Xerte Online Toolkits. The import.php file, which handles template import operations, fails to properly validate whether the requesting user has been authenticated before processing file upload requests. This architectural flaw allows unauthenticated remote attackers to directly interact with the import functionality, bypassing the intended access controls.

The exploitation chain involves crafting a malicious ZIP archive that contains PHP code disguised or placed within the expected template structure. When this archive is uploaded through the vulnerable import endpoint, the server extracts its contents to a web-accessible directory without sanitizing the file types or contents. Since the extraction path is publicly accessible, attackers can then directly request the malicious PHP file via HTTP, causing the web server to execute the embedded code with the privileges of the web server process.

Root Cause

The root cause of CVE-2026-32985 is the absence of authentication verification in the template import handling code. The import.php script processes incoming ZIP archive uploads and extracts their contents without first confirming that the request originates from an authenticated and authorized user. Additionally, there is no validation of the file types within the uploaded archive, allowing PHP files to be included and subsequently executed. This combination of missing authentication and inadequate file type filtering creates a direct path to remote code execution.

Attack Vector

The attack is conducted over the network without requiring any authentication or user interaction. An attacker identifies a vulnerable Xerte Online Toolkits installation and sends a specially crafted HTTP request to the import.php endpoint containing a malicious ZIP archive. The archive is structured to place a PHP webshell or other malicious script in the media directory path. Upon successful upload and extraction, the attacker accesses the uploaded PHP file directly through its web-accessible URL, triggering execution of arbitrary code within the web server's context. This grants the attacker the ability to run system commands, access sensitive files, establish persistence, or pivot to other systems on the network.

Detection Methods for CVE-2026-32985

Indicators of Compromise

• Unexpected HTTP POST requests to /import.php or similar template import endpoints from external IP addresses
• Newly created PHP files in the media or template directories with suspicious content or webshell patterns
• Web server access logs showing direct requests to unfamiliar PHP files in typically static content directories
• Outbound network connections originating from the web server process to unknown external hosts

Detection Strategies

• Monitor web server logs for unauthenticated POST requests to import-related PHP endpoints containing ZIP file uploads
• Implement file integrity monitoring on the Xerte installation directory to detect unauthorized file creation or modification
• Deploy web application firewall rules to block suspicious file upload patterns and ZIP archives containing PHP content
• Use endpoint detection to identify webshell behavior patterns such as command execution from PHP processes

Monitoring Recommendations

• Enable detailed logging for all file upload operations within the Xerte Online Toolkits application
• Configure alerts for new PHP file creation in web-accessible directories outside of normal deployment processes
• Monitor for anomalous process spawning from web server workers, particularly shell invocations
• Review network traffic for signs of command and control communication originating from the web server

How to Mitigate CVE-2026-32985

Immediate Actions Required

• Restrict network access to the import.php endpoint using firewall rules or web server configuration to allow only trusted IP addresses
• If the template import functionality is not required, disable or remove the import.php file entirely
• Implement authentication at the web server level (e.g., HTTP Basic Auth) for the import endpoint as an interim measure
• Conduct a thorough review of the media and template directories for any unexpected PHP files that may indicate prior compromise

Patch Information

Organizations should monitor the official Xerte Project for security updates and patched releases that address CVE-2026-32985. Until an official patch is available, implement the workarounds and network-level controls described below. Technical details about the vulnerability are available from the Packet Storm advisory.

Workarounds

• Block external access to the template import functionality using web server access controls or firewall rules
• Configure the web server to disallow PHP execution in the media and template upload directories using directives such as php_flag engine off
• Implement network segmentation to isolate the Xerte server from critical internal resources
• Deploy a web application firewall with rules to inspect and block malicious file uploads

# Apache configuration to disable PHP execution in upload directories
<Directory "/var/www/xerte/media">
    php_flag engine off
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5 .phps
</Directory>