Vulnerability · Published Apr 22, 2026 · Assigned by VulnCheck

CVE-2026-41459Xerte Online Toolkits Path Disclosure via /setup

Medium 5.3

In plain English

A medium-severity security flaw in xerteonlinetoolkits from thexerteproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 43.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Metasploit

Official description

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.

Affected products (as reported)

Vendor	Product	Versions
thexerteproject	xerteonlinetoolkits	3.15.00 – before f063e942b4a9bf77a06829e844c2c70316bc45e8

Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/bootstrapbool/xerteonlinetoolkits-rce technical-description, exploit
https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html release-notes
https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits product, permissions-required
https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527 issue-tracking
https://github.com/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8 patch
https://www.vulncheck.com/advisories/xerte-online-toolkits-path-disclosure-via-setup third-party-advisory