# Xerte E-Learning Toolkit Flaws Enable Unauth RCE Published: 2026-07-09 · Severity: medium · Sectors: education Canonical: https://vorant.io/reports/f660bfe2-85bd-5115-943a-14402c888356/xerte-e-learning-toolkit-flaws-enable-unauth-rce > Two chained vulnerabilities in Xerte Online Toolkits let unauthenticated attackers gain admin access and achieve remote code execution. CERT/CC disclosed two vulnerabilities in Xerte Online Toolkits, an open-source e-learning authoring platform. CVE-2026-14261 stems from a persistent /setup/ installation directory that lacks access controls, allowing an unauthenticated attacker to reconfigure the application to point to an attacker-controlled database and gain administrative access. Once admin access is obtained, CVE-2026-12116 can be exploited by editing the configured antivirus binary path in the tools server settings, redirecting it to a PHP interpreter so that uploaded files bypass extension checks and are executed as PHP, resulting in full remote code execution. Chaining these two flaws gives an unauthenticated attacker a complete path from initial access to code execution on the underlying server, enabling persistent access, data exfiltration, or supply-chain-style compromise of educational content distributed through the platform. The vendor has released fixes in versions 3.15.5 and 3.14.6, along with commits that automatically remove the /setup/ folder post-installation and relocate sensitive configuration such as the antivirus binary path to server-side storage. Administrators are urged to manually delete residual /setup/ directories and upgrade immediately, running upgrade.php to apply the hardening. ## Mentioned in this report - Vulnerabilities: CVE-2026-12116, CVE-2026-14261 ## Detection guidance (public sample) ### Unauthenticated Access to Residual Xerte /setup/ Directory ATT&CK: T1190 Detects HTTP requests to the Xerte Online Toolkits /setup/ installation path, which should not persist post-install and allows unauthenticated database/admin reconfiguration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Unauthenticated Access to Residual Xerte /setup/ Directory id: edff88f2-659d-5b1a-abeb-0cca976ca0df status: experimental description: Detects HTTP requests to the Xerte Online Toolkits /setup/ installation path, which should not persist post-install and allows unauthenticated database/admin reconfiguration (CVE-2026-14261). references: - CERT/CC Xerte Online Toolkits advisory logsource: category: webserver detection: selection: cs-uri-stem|contains: /setup/ method_flag: cs-method: - POST - GET condition: selection and method_flag fields: - cs-uri-stem - cs-method - c-ip - cs-uri-query falsepositives: - Legitimate first-time installation of Xerte immediately after deployment - Internal vulnerability scanning against the /setup/ path tags: - attack.t1190 level: high author: Vorant ``` ### PHP Interpreter Spawned as Configured Antivirus Scanner by Web Server ATT&CK: T1190 Detects a web/application server process (e.g. Apache, nginx, php-fpm) spawning a PHP interpreter against an uploaded file with a non-PHP extension, consistent with Xerte's antivirus-binary-path setting being redirected to php to bypass upload extension checks (CVE-2026-12116). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: PHP Interpreter Spawned as Configured Antivirus Scanner by Web Server id: d370f1a3-2eff-5d0e-9115-bde00b802956 status: experimental description: Detects a web server or PHP-FPM parent process invoking a PHP interpreter binary against a recently uploaded file, matching the Xerte flaw where the configured antivirus scanner path is redirected to the PHP interpreter so uploads are executed as code instead of scanned. references: - CERT/CC Xerte Online Toolkits advisory logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /httpd - /apache2 - /nginx - /php-fpm Image|endswith: - /php - /php-cgi - /php7 - /php8 upload_path: CommandLine|contains: - /uploads/ - /tmp/php - /tools/ condition: selection and upload_path falsepositives: - Legitimate PHP-based antivirus wrapper scripts stored under upload/tools directories - Custom deployment scripts that invoke php CLI for maintenance on upload folders tags: - attack.t1190 level: high author: Vorant ``` ### Web Server Child Process Executing Shell Commands (Possible Web Shell) ATT&CK: T1505.003 Detects a web server or PHP process spawning a command interpreter, indicative of a web shell dropped via the Xerte upload-bypass RCE chain being used to execute OS commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Web Server Child Process Executing Shell Commands (Possible Web Shell) id: 1d200e96-6eb8-5e12-8147-65561f3c9aab status: experimental description: Detects sh/bash/cmd child processes spawned by web server or PHP interpreter processes, consistent with post-exploitation web shell command execution following the Xerte unauthenticated RCE chain. references: - CERT/CC Xerte Online Toolkits advisory logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /httpd - /apache2 - /nginx - /php-fpm - /php - /php-cgi Image|endswith: - /sh - /bash - /dash - /curl - /wget - /nc - /id - /whoami condition: selection falsepositives: - Legitimate PHP scripts that shell out to system utilities as part of normal application logic - Health-check or monitoring scripts executed by the web server user tags: - attack.t1505.003 - attack.t1190 level: medium author: Vorant ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. 1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers. Source reporting: https://kb.cert.org/vuls/id/734812 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f660bfe2-85bd-5115-943a-14402c888356/xerte-e-learning-toolkit-flaws-enable-unauth-rce. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup