CVE-2026-4169: Tecnick TCExam XSS Vulnerability

CVE-2026-4169 Overview

A Cross-Site Scripting (XSS) vulnerability has been discovered in Tecnick TCExam versions up to 16.6.0. The vulnerability affects the F_xml_export_users function located in the file admin/code/tce_xml_users.php within the XML Export component. By manipulating input parameters, an attacker can inject malicious scripts that execute in the context of an administrator's browser session.

Critical Impact

This stored XSS vulnerability in the XML Export functionality could allow attackers to execute arbitrary JavaScript code in administrator browsers, potentially leading to session hijacking, credential theft, or unauthorized actions within the TCExam platform.

Affected Products

• Tecnick TCExam versions up to and including 16.6.0
• TCExam XML Export component (admin/code/tce_xml_users.php)
• Installations utilizing the F_xml_export_users function

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-4169 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-4169

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the XML Export functionality of TCExam, where user-supplied data is not properly sanitized before being included in XML output. When administrators export user data to XML format, unsanitized fields can contain malicious JavaScript that executes when the exported data is viewed or processed.

It is worth noting that the vendor has expressed uncertainty about the security impact of this vulnerability. According to the vendor: "This is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective." This limited attack surface is reflected in the vulnerability's classification and scoring.

Root Cause

The root cause of this vulnerability lies in the failure to properly sanitize XML fields before export. The F_xml_export_users function in tce_xml_users.php did not apply adequate output encoding or escaping to user-controlled data before including it in the generated XML output. This allows specially crafted input containing script tags or JavaScript event handlers to be embedded in the export and potentially executed in a browser context.

Attack Vector

The attack requires network access and targets the administrative XML export functionality. An attacker with administrator privileges could inject malicious scripts into user fields that would then be included in XML exports. When another administrator views or processes this exported data in a browser context, the injected script would execute. The attack requires both privileged access to create the payload and user interaction to trigger execution, which significantly limits the practical attack surface.

+16.6.1 (2026-03-004)
+	- Update TCPDF.
+	- Sanitize XML fields.
+
 16.6.0 (2026-03-01)
 	- Update Session handlers (requires PHP 7+).
 	- Tydy up some code.

Source: GitHub Commit 899b5b2f

Detection Methods for CVE-2026-4169

Indicators of Compromise

• Unusual or encoded script content within user profile fields in the TCExam database
• XML export files containing <script> tags or JavaScript event handlers
• Unexpected outbound network connections from administrator browsers after viewing XML exports
• Modified user records with suspicious payloads in name, email, or other exported fields

Detection Strategies

• Review TCExam access logs for unusual activity related to tce_xml_users.php
• Implement content security policies (CSP) to prevent inline script execution
• Monitor for XSS attack patterns in web application firewall (WAF) logs
• Conduct periodic audits of user data fields for suspicious content

Monitoring Recommendations

• Enable detailed logging for all XML export operations in TCExam
• Configure alerting for modifications to user profile fields by administrative accounts
• Deploy browser-based XSS protection and monitor for triggered alerts
• Review exported XML files for script injection patterns before distribution

How to Mitigate CVE-2026-4169

Immediate Actions Required

• Upgrade Tecnick TCExam to version 16.6.1 or later immediately
• Audit existing user records for any suspicious content in exportable fields
• Implement Content Security Policy headers to mitigate potential XSS impact
• Restrict administrative access to only trusted personnel

Patch Information

The vulnerability has been addressed in TCExam version 16.6.1. The fix implements proper sanitization of XML fields before export, preventing script injection. The security patch is available in commit 899b5b2fa09edfe16043f07265e44fe2022b7f12. Organizations should upgrade to the patched version as described in the GitHub Release Notes for version 16.6.1.

Workarounds

• Limit XML export functionality to highly trusted administrators only
• Manually sanitize or review all user-submitted data before export operations
• Use external XML parsing tools that do not render JavaScript when processing exports
• Implement additional input validation on user profile fields to reject script content

# Verify current TCExam version and upgrade
cd /path/to/tcexam
git fetch --tags
git checkout 16.6.1

# Alternatively, download the latest release
wget https://github.com/tecnickcom/tcexam/archive/refs/tags/16.6.1.tar.gz
tar -xzf 16.6.1.tar.gz