CVE-2026-41459: Xerte Online Toolkits Path Disclosure via /setup
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the /setup page so unauthenticated users cannot reach it (e.g., via web server access controls such as IP allowlists or authentication), to prevent disclosure of the root_path value.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41459?
CVE-2026-41459 is classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-41459?
To mitigate CVE-2026-41459, upgrade Xerte Online Toolkits to version 3.16 or later where this vulnerability is addressed.
What types of systems are affected by CVE-2026-41459?
CVE-2026-41459 affects Xerte Online Toolkits versions 3.15 and earlier.
What can attackers do with CVE-2026-41459?
Attackers can exploit CVE-2026-41459 to retrieve the full server-side filesystem path of the application root, potentially leading to further attacks.
Is authentication required to exploit CVE-2026-41459?
No, CVE-2026-41459 can be exploited by unauthenticated attackers, making it particularly concerning.