Xerte E-Learning Toolkit Flaws Enable Unauth RCE
Two chained vulnerabilities in Xerte Online Toolkits let unauthenticated attackers gain admin access and achieve remote code execution.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed two vulnerabilities in Xerte Online Toolkits, an open-source e-learning authoring platform. CVE-2026-14261 stems from a persistent /setup/ installation directory that lacks access controls, allowing an unauthenticated attacker to reconfigure the application to point to an attacker-controlled database and gain administrative access. Once admin access is obtained, CVE-2026-12116 can be exploited by editing the configured antivirus binary path in the tools server settings, redirecting it to a PHP interpreter so that uploaded files bypass extension checks and are executed as PHP, resulting in full remote code execution.
Chaining these two flaws gives an unauthenticated attacker a complete path from initial access to code execution on the underlying server, enabling persistent access, data exfiltration, or supply-chain-style compromise of educational content distributed through the platform. The vendor has released fixes in versions 3.15.5 and 3.14.6, along with commits that automatically remove the /setup/ folder post-installation and relocate sensitive configuration such as the antivirus binary path to server-side storage. Administrators are urged to manually delete residual /setup/ directories and upgrade immediately, running upgrade.php to apply the hardening.
Mentioned in this report
Detection guidance
Unauthenticated Access to Residual Xerte /setup/ Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the Xerte Online Toolkits /setup/ installation path, which should not persist post-install and allows unauthenticated database/admin reconfiguration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to Residual Xerte /setup/ Directory
id: edff88f2-659d-5b1a-abeb-0cca976ca0df
status: experimental
description: Detects HTTP requests to the Xerte Online Toolkits /setup/ installation
path, which should not persist post-install and allows unauthenticated database/admin
reconfiguration (CVE-2026-14261).
references:
- CERT/CC Xerte Online Toolkits advisory
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /setup/
method_flag:
cs-method:
- POST
- GET
condition: selection and method_flag
fields:
- cs-uri-stem
- cs-method
- c-ip
- cs-uri-query
falsepositives:
- Legitimate first-time installation of Xerte immediately after deployment
- Internal vulnerability scanning against the /setup/ path
tags:
- attack.t1190
level: high
author: Vorant
PHP Interpreter Spawned as Configured Antivirus Scanner by Web Server
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web/application server process (e.g. Apache, nginx, php-fpm) spawning a PHP interpreter against an uploaded file with a non-PHP extension, consistent with Xerte's antivirus-binary-path setting being redirected to php to bypass upload extension checks (CVE-2026-12116). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Interpreter Spawned as Configured Antivirus Scanner by Web Server
id: d370f1a3-2eff-5d0e-9115-bde00b802956
status: experimental
description: Detects a web server or PHP-FPM parent process invoking a PHP interpreter
binary against a recently uploaded file, matching the Xerte flaw where the configured
antivirus scanner path is redirected to the PHP interpreter so uploads are executed
as code instead of scanned.
references:
- CERT/CC Xerte Online Toolkits advisory
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
Image|endswith:
- /php
- /php-cgi
- /php7
- /php8
upload_path:
CommandLine|contains:
- /uploads/
- /tmp/php
- /tools/
condition: selection and upload_path
falsepositives:
- Legitimate PHP-based antivirus wrapper scripts stored under upload/tools directories
- Custom deployment scripts that invoke php CLI for maintenance on upload folders
tags:
- attack.t1190
level: high
author: Vorant
Web Server Child Process Executing Shell Commands (Possible Web Shell)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP process spawning a command interpreter, indicative of a web shell dropped via the Xerte upload-bypass RCE chain being used to execute OS commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Child Process Executing Shell Commands (Possible Web Shell)
id: 1d200e96-6eb8-5e12-8147-65561f3c9aab
status: experimental
description: Detects sh/bash/cmd child processes spawned by web server or PHP interpreter
processes, consistent with post-exploitation web shell command execution following
the Xerte unauthenticated RCE chain.
references:
- CERT/CC Xerte Online Toolkits advisory
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php
- /php-cgi
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /id
- /whoami
condition: selection
falsepositives:
- Legitimate PHP scripts that shell out to system utilities as part of normal application
logic
- Health-check or monitoring scripts executed by the web server user
tags:
- attack.t1505.003
- attack.t1190
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/734812
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs