Xerte E-Learning Toolkit Flaws Enable Unauth RCE
Two chained vulnerabilities in Xerte Online Toolkits let unauthenticated attackers gain admin access and achieve remote code execution.
CERT/CC disclosed two vulnerabilities in Xerte Online Toolkits, an open-source e-learning authoring platform. CVE-2026-14261 stems from a persistent /setup/ installation directory that lacks access controls, allowing an unauthenticated attacker to reconfigure the application to point to an attacker-controlled database and gain administrative access. Once admin access is obtained, CVE-2026-12116 can be exploited by editing the configured antivirus binary path in the tools server settings, redirecting it to a PHP interpreter so that uploaded files bypass extension checks and are executed as PHP, resulting in full remote code execution.
Chaining these two flaws gives an unauthenticated attacker a complete path from initial access to code execution on the underlying server, enabling persistent access, data exfiltration, or supply-chain-style compromise of educational content distributed through the platform. The vendor has released fixes in versions 3.15.5 and 3.14.6, along with commits that automatically remove the /setup/ folder post-installation and relocate sensitive configuration such as the antivirus binary path to server-side storage. Administrators are urged to manually delete residual /setup/ directories and upgrade immediately, running upgrade.php to apply the hardening.
Mentioned in this report
Detection guidance
Unauthenticated Access to Residual Xerte /setup/ Directory
Detects HTTP requests to the Xerte Online Toolkits /setup/ installation path, which should not persist post-install and allows unauthenticated database/admin reconfiguration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to Residual Xerte /setup/ Directory
id: edff88f2-659d-5b1a-abeb-0cca976ca0df
status: experimental
description: Detects HTTP requests to the Xerte Online Toolkits /setup/ installation
path, which should not persist post-install and allows unauthenticated database/admin
reconfiguration (CVE-2026-14261).
references:
- CERT/CC Xerte Online Toolkits advisory
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /setup/
method_flag:
cs-method:
- POST
- GET
condition: selection and method_flag
fields:
- cs-uri-stem
- cs-method
- c-ip
- cs-uri-query
falsepositives:
- Legitimate first-time installation of Xerte immediately after deployment
- Internal vulnerability scanning against the /setup/ path
tags:
- attack.t1190
level: high
author: Vorant
PHP Interpreter Spawned as Configured Antivirus Scanner by Web Server
Detects a web/application server process (e.g. Apache, nginx, php-fpm) spawning a PHP interpreter against an uploaded file with a non-PHP extension, consistent with Xerte's antivirus-binary-path setting being redirected to php to bypass upload extension checks (CVE-2026-12116). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Interpreter Spawned as Configured Antivirus Scanner by Web Server
id: d370f1a3-2eff-5d0e-9115-bde00b802956
status: experimental
description: Detects a web server or PHP-FPM parent process invoking a PHP interpreter
binary against a recently uploaded file, matching the Xerte flaw where the configured
antivirus scanner path is redirected to the PHP interpreter so uploads are executed
as code instead of scanned.
references:
- CERT/CC Xerte Online Toolkits advisory
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
Image|endswith:
- /php
- /php-cgi
- /php7
- /php8
upload_path:
CommandLine|contains:
- /uploads/
- /tmp/php
- /tools/
condition: selection and upload_path
falsepositives:
- Legitimate PHP-based antivirus wrapper scripts stored under upload/tools directories
- Custom deployment scripts that invoke php CLI for maintenance on upload folders
tags:
- attack.t1190
level: high
author: Vorant
Web Server Child Process Executing Shell Commands (Possible Web Shell)
Detects a web server or PHP process spawning a command interpreter, indicative of a web shell dropped via the Xerte upload-bypass RCE chain being used to execute OS commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Child Process Executing Shell Commands (Possible Web Shell)
id: 1d200e96-6eb8-5e12-8147-65561f3c9aab
status: experimental
description: Detects sh/bash/cmd child processes spawned by web server or PHP interpreter
processes, consistent with post-exploitation web shell command execution following
the Xerte unauthenticated RCE chain.
references:
- CERT/CC Xerte Online Toolkits advisory
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php
- /php-cgi
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /id
- /whoami
condition: selection
falsepositives:
- Legitimate PHP scripts that shell out to system utilities as part of normal application
logic
- Health-check or monitoring scripts executed by the web server user
tags:
- attack.t1505.003
- attack.t1190
level: medium
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/734812
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free