CVE-2026-41459
published 2026-04-22CVE-2026-41459: Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full…
PriorityP339medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
0.80%
52.0th percentile
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| thexerteproject | xerteonlinetoolkits | < f063e942b4a9bf77a06829e844c2c70316bc45e8 | f063e942b4a9bf77a06829e844c2c70316bc45e8 |
| thexerteproject | xerteonlinetoolkits | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
thexerteproject xerteonlinetoolkits up to 3.15.0 GET Request /setup root_path exposure of sensitive system information to an unauthorized control sphere (ID 1527)
vuldb·2026-04-22·CVSS 6.9
CVE-2026-41459 [MEDIUM] thexerteproject xerteonlinetoolkits up to 3.15.0 GET Request /setup root_path exposure of sensitive system information to an unauthorized control sphere (ID 1527)
A vulnerability, which was classified as problematic, has been found in thexerteproject xerteonlinetoolkits up to 3.15.0. Impacted is an unknown function of the file /setup of the component GET Request Handler. The manipulation of the argument root_path leads to exposure of sensitive system information to an unauthorized control sphere.
This vulnerability is referenced as CVE-2026-41459. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
GHSA-53wm-fw97-q62h: Xerte Online Toolkits versions 3
ghsa_unreviewed·2026-04-22
CVE-2026-41459 [MEDIUM] CWE-497 GHSA-53wm-fw97-q62h: Xerte Online Toolkits versions 3
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
No detection rules found.
https://github.com/bootstrapbool/xerteonlinetoolkits-rcehttps://github.com/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527https://www.vulncheck.com/advisories/xerte-online-toolkits-path-disclosure-via-setuphttps://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkitshttps://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html
2026-04-22
Published