Vulnerability · Published Sep 1, 2026 · Assigned by INCIBE
CVE-2026-4813Code injection in the Lutece Core
Critical 9.4
In plain English
A critical-severity code injection in Lutece Core from Lutece. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lutece | Lutece Core | 0 – before 7.1.7 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H