CVE-2026-32985
Published: 20 March 2026
Summary
CVE-2026-32985 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Apereo Xerte Online Toolkits. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality. The flaw, assigned CVE-2026-32985 and carrying a CVSS 4.0 score of 9.3, arises from missing authentication enforcement (CWE-306) combined with unrestricted upload of dangerous file types (CWE-434) in import.php, allowing remote attackers to supply a crafted ZIP archive that embeds malicious PHP payloads.
An attacker can bypass the authentication checks, upload the archive, and have its contents extracted into a web-accessible media directory. The resulting PHP files can then be directly requested and executed in the context of the web server, achieving full remote code execution without any user interaction or credentials.
The current and peak EPSS values are both recorded at 0.7000. Public references include a Packet Storm entry and the Xerte project site.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13416
Vulnerability details
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass…
more
authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary file upload in public-facing web application enables remote code execution via crafted PHP payloads acting as web shells (T1190: Exploit Public-Facing Application; T1100: Web Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication and authorization checks on import.php before any file upload or extraction is permitted.
Requires validation of uploaded ZIP contents to reject dangerous file types such as PHP before extraction to a web-accessible path.
Restricts the template-import capability and permitted file types to only those required, eliminating the unrestricted upload vector.